The Microsoft 365 experience – Teams, Exchange, Outlook, Edge: Where did SharePoint Go? – Records about the world
Annotations:
-
The best way to do this is to add records managers to a Security Group and then add that Group to the SCA group of every site. This access could be deferred for sites that contain very sensitive information, although typically records managers would have access to all records, including if they had an EDRMS. And, access is always recorded in audit logs or the local site ‘viewers’ (where enabled) and ‘last modified by’ information.
-
- The chat content in 1:1 chats.
- The chat content in the various Teams.
- SharePoint sites linked with Teams.
- Exchange mailboxes.
- OneDrive for Business accounts. An additional consideration is how long the content of inactive ODfB acccounts should be retained via the ‘Storage’ policy (default is 30 days then permanent deletion).
- SharePoint sites not linked with MS Teams. This includes whole sites as well as library-based retention policies.
- Office 365 Groups (mailbox/SharePoint site). If linked with a Team, a second retention policy is required for the Team chat content retention (second dot point above). For example, one policy ‘GroupABC’ and a second policy ‘GroupABCTeamChat’.
Records managers will also need to advise on the appropriate retention policy or policies that need to be created and then applied to:
-
As many of the above retention policies replace the need for backups, records managers need to discuss the options with their IT colleagues.
-
In this new world, the role of records managers will change from being the curators of records copied to and stored in a separate ‘records and document management’ system, to being records compliance analysts or perhaps, corporate knowledge and information managers and content analysts.
Why Microsoft Information Governance initiatives MUST go beyond risk management?
Annotations:
-
Industries such as financial services, oil and gas, nuclear energy, life sciences, healthcare, and the public sector are subject to specific laws or regulations dictating the long-term retention of specific information types — but a single compliance-driven thinking doesn’t help protect less-regulated information within the same organisation. A single compliance-driven approach also does not resonate with every enterprise user beyond the compliance teams, leaving such programmes with a narrow business case resulting in poor user adoption and very little change in behaviours to manage information effectively to deliver value.
-
Don't kick the can down the road!
Companies must adopt a mindset that compliance-driven governance is a minimum threshold instead of the entire scope.
Long term Information Governance risks and benefits are real — act Today even if IT landscape isn't Perfect
Actively plan for long-term retention of data that holds corporate memory and plan to automatically dispose the information beyond its legitimate purpose