eDiscovery Best Practices in SharePoint Server 2013 and Office 365 "From the Consulting Trenches"

Not only do records stored on users devices and in SharePoint become relevant in legal and compliance related cases and incidents, but emails as well as even Lync conversations also fall into eDiscovery requests more and more every day.

The new eDiscovery features and functionality in SharePoint Server 2013 and Office 365's SharePoint Online provides improved methods to help protect your organization as well as its team members. Some of the new and added capabilities around eDiscovery in SharePoint Server 2013 and Office 365 include:

• Improved support for searching and exporting content from file shares

• The ability to have a dedicated site collection for which you can perform eDiscovery queries across multiple SharePoint instances, farms and Exchange servers that will store and preserve the items that are discovered

• Features that allow you to export discovered content from Exchange Server 2013 and SharePoint Server 2013 to ensure you are able to meet timely requests or related court orders

• The ability for in-place preservation of Exchange mailboxes and SharePoint sites that also include SharePoint list items and SharePoint pages.

• The ability to create site mailboxes to store email in a comprehensive manner related to a specific project or effort

SharePoint Server 2013’s ability to managing discovery cases and holds comes in the form of a new eDiscovery Center site template which creates a portal through which you can access discovery cases to conduct the required searches.

When you have conducted the relevant searches, you are able to place content on hold as well as export the content to meet the needs or your organization and its legal counsel.

It is important to remember that for each individual case, you must create a new site that uses SharePoint Server 2013’s eDiscovery Case site template.

The Need for a Tailored Approach

Every case correlates to a collaboration site that includes a document library for you and your organization’s legal team members to use to store documents related to the management of the case while demonstrating to the court or matter’s governing body your companies preparedness and due diligence in having a process in place for such matters.

This not only benefits your organization but can also give your organization the upper hand by ensuring you have all relevant information available for your counsel as time is always of the essence in these types of matters.

You are also able to associate the following items with each case:

• The source for which the information was derived from such as SharePoint, Exchange, File Shares, etc.

• The specific search criteria for which your organization ran to prove your due diligence and extraordinary efforts to meet the courts or opposing counsel’s request.

• The actual eDiscovery sets that may include all of the sources as well as complete list of queries and filters as well as the actual exports that were produced in relation to the case

An added plus to this process is that if additional requests are made by the court or requesting party, you are able to build upon or add new queries to further refine searches and the related retrieved content.

When content in SharePoint Server 2013 is put on hold and is preserved, the state of the content at the time of that preservation is recorded but that does not mean work on a project by team members must cease.

SharePoint will still allow content to be updated or changed but the content that was put on hold and preserved will not change as those “copies” and/or “records” are being preserved and the content the users are working on are simply new content and records which can also be preserved if needed at any time by implementing a new hold on these updated records.

This allows a project and your business to continue being productive as this matter is being resolved which in many cases may take several years.

It is important to note that Records Managers or Compliance Officers who have permissions to use the eDiscovery features of SharePoint Server 2013 can access the original, preserved versions of content at any time.

When performing a SharePoint eDiscovery export, the locations for which the content resides may cause the export type to differ.

For example, you may have documents that are exported from file shares where no version history is available but documents from a SharePoint document library will have their version history intact when exported from SharePoint Server 2013.

If an item in a SharePoint list was included in the eDiscovery query results, the complete list is exported as a comma-separated values (.csv) file. SharePoint pages such as wiki pages or blogs are exported as MIME HTML (.mht) files.

Microsoft Exchange items or objects in an Exchange Server 2013 mailbox, such as tasks, calendar entries, email messages, contacts and attachments, are exported as a .pst file.

To ensure compliance, a complete XML manifest that complies with the Electronic Discovery Reference Model (EDRM) specification is made available that provides an overview of all the exported information.

The following is a detailed list of capabilities of the SharePoint Server 2013 eDiscovery Center:

• SharePoint 2013 In-Place Holds

• Exchange 2013 In-Place Holds

• Query-based preservation

• Bulk Metadata Update

• Content Drag & Drop

• Exchange Site Mailboxes

• Improved Video Handling

• Search Enhancements

• CMIS update to CMIS 1.0

Microsoft Exchange and SharePoint 2013 Integration Capabilities

The overall integration of Microsoft Exchange and SharePoint 2013 consists of the following:

• Site Mailboxes have their own unique email address

• Emails are stored in Microsoft Exchange

• Documents and emails are stored in both SharePoint and Outlook

• Your organization can manage emails as records that include Site Retention

• You are able to drag emails from Outlook into SharePoint 2013

• Mobile Access is native to meet the needs of the ever changing mobile IT world and BYOD demands

Site Mailbox Feature in SharePoint Server 2013

SharePoint Server 2013’s Site Mailbox feature, as shown in the figure below, provides for the following capabilities:

• An Exchange Mailbox is created per site for which information management policies can be applied and governed

• The ability to drag emails in to SharePoint document library for which retention and information management policies are then available to be applied based on your organization’s specific requirements or configuration

• The ability to apply an expiration policy for both SharePoint and Site Mailboxes

A high-level flow of SharePoint 2013’s Site Mailbox functionality is shown in the image below.

High-level Flow of SharePoint 2013’s Site Mailbox Functionality

Site Mailboxes and Lifecycle Management

An overview of the provisioning of SharePoint Server 2013 | Office 365 Site Mailboxes are as follows:

• They are available to be provisioned OOTB from a SharePoint site provided Exchange 2013 integration is in place

• They provide for customized self-service provisioning from Outlook

• The Site mailbox is deleted together with SharePoint site

• Site deletion can be manual or policy driven in relation to any Site mailbox considerations
• Site mailboxes are only marked for deletion in Exchange

The overall lifecycle of a Site Mailbox must be defined within your organization’s information management policies.

An example of a SharePoint Server 2013’s Site Mailbox overall lifecycle is shown in the image below.

The Lifecycle of a Site Mailbox

The following should be kept in mind at all times regarding SharePoint’s Site Mailbox feature.

• The site connection must be restored when the SharePoint site’s URL is changed and/or modified

• Site Mailboxes can be accessed by any users with at least read/write access to the site

• For information security precautions, it is important to use naming standards with the email address prefix as specified in your organization’s provisioning policy

SharePoint 2013 and Office 365 Application Development "From the Consulting Trenches"

This is the first in a series of blog posts I will build on regarding SharePoint 2013, Office 365, and SharePoint Online eDiscovery strategies and best practices “from the consulting trenches.”

EPC Group leading SharePoint, Office 365, Infrastructure Design and Business Intelligence Practice areas continue to lead the way in providing our clients with the most up-to-date and relevant information that is tailored to their individual business and functional needs.

Additional "From the Consulting Trenches" strategies and methodologies are covered in EPC Group's new book, "SharePoint 2013 Field Guide: Advice from the Consulting Trenches" covering not only SharePoint 2013, Office 365 and SharePoint Online but Information Management, ECM\RM and overall compliance strategies in this ever changing world of "Hybrid IT."