State Records Office of Western Australia
www.sro.wa.gov.au
Records Management Advice November 2019
Information Management Using SharePoint
SharePoint is a collaborative platform that is integrated with Microsoft Office 365 products. SharePoint allows an organisation to store, search, access, track, manage and report on digital information.
Remember
The information management capability of SharePoint varies depending on the software service used, type of license held and whether SharePoint is integrated with an Electronic Document and Records Management System (EDRMS), Enterprise Content Management (ECM) or any other add-ons.
Effective information management aims to ensure that:
• Full, reliable and accurate information is created, captured and managed
• The integrity of information and associated metadata is maintained
• People can find what they are looking for when they need it
• Information is secure from unauthorised access, alteration and destruction
• Accessible information is exported from the system when required
• Information remains accessible for as long as required.
When using SharePoint as a standalone product:
• Documents can be created in, saved into, or dragged and dropped into SharePoint.
• Each document created or saved into SharePoint is allocated a Unique ID. The Unique ID is sequential and is never repeated, so if a document is deleted its number is not reused.
• SharePoint automatically generates system metadata for documents based on selected fields, such as: titles, content, date and time, creator, modifier, modified date etc.
• To aid in discoverability further metadata can be added and customised at various levels within SharePoint.
• System generated metadata stays with the document even when it is downloaded or emailed.
• Security or permissions can be set up within all levels of SharePoint.
• SharePoint allows for documents to be imported and exported.
State Records Office of Western Australia
www.sro.wa.gov.au What about Retention and Disposal?
If SharePoint is integrated with another system such as an EDRMS that handles disposal then the disposals can continue to be applied by that system through traditional methods.
If there is no integration, then disposal will need to be managed within SharePoint.
There are two ways to manage retention and disposal:
• If you are using SharePoint through a Microsoft 365 subscription then disposal can be managed through Data Governance Retention policies in the Security and Compliance Centre. Using the Data Governance function enables retention to be applied “behind the scenes” without user involvement.
• If you are not using SharePoint as part of Microsoft 365, then retention and disposal can be administered by using labels and labelling policies. At present labels must be manually applied, this requires the user to be aware of the organisation’s retention policy to select the appropriate label/retention each time a document is captured by or created in SharePoint.
It is recommended that all records be subject to a disposition review before being permanently deleted.
What about audit trails?
At present SharePoint only retains audit logs for 90 days. If SharePoint is to be used without an add-on to manage audit logs the logs must be downloaded manually every 90 days and stored in the system.
Depending on the set-up, audits may be obtained through Azure, but this will require collaboration with Information Technology (IT).
What next?
Information Managers will need to be familiar with Microsoft 365 and/or SharePoint.
Setting up Microsoft 365 and SharePoint requires a collaborative effort that involves coordination between senior management, IT professionals, Chief Information Officers (CIOs) and Information Managers who have expert knowledge in the requirements of the State Records Act 2000.
When implementing SharePoint across an organisation it is advisable to use someone with expertise in implementing a SharePoint platform for Government organisations so that it meets the appropriate legislative requirements.
To achieve information management functionality and compliance SharePoint is best configured at the tenant level through Microsoft 365, then in turn tenant-level policies and settings can be applied to sites as well as OneDrive and other areas/apps of Microsoft 365 (Outlook, Teams, etc.).
State Records Office of Western Australia
www.sro.wa.gov.au It is best if information management controls are considered during the planning and
configuration stage, however if this does not happen, various controls can be introduced post-implementation at the site collection, list or library level.
For example:
• Labels can be used to manage document retention and security classification.
• Access permissions can be granted through SharePoint site permissions to sites, and libraries.
• Metadata can be applied at different levels within SharePoint and is fully customisable for different business purposes.
If your organisation intends to have several individuals creating sites, and managing permissions and security groups the State Records Office recommends that you should develop a SharePoint Governance Plan.
A Governance Plan may incorporate the architecture, ownership, roles and responsibilities for sites, security and permissions, metadata and external sharing guidelines, third-party add-ons and integrations with other systems, and how any issues are dealt with.
Templates for developing a SharePoint Governance Plan can be found on the Internet.
These may be useful for organisations to use as a basis for developing their own Governance Plan.
As SharePoint is highly customisable, it is advisable to document all configuration settings and make sure any changes are approved and logged.
Remember
One of the most important things to remember about SharePoint is that it is an online product and updates are constantly being rolled out. What it may not do today, it may do tomorrow.
To assist with the constant rollouts Microsoft has developed a Microsoft 365 Roadmap webpage where you can view what’s in development, being rolled out, or already launched.
For further information, contact the State Records Office at [email protected] References and Resources
http://www.SharePointMaven.com
https://sharepointmaven.com/the-ultimate-sharepoint-governance-template/
https://sharegate.com/blog/real-world-sharepoint-governance-plan
