Blogs

This post describes a set of additional requirements that extend the records management capabilities of SharePoint 2010 to be an enterprise solution that doesn't require a separate content management or records management repository.  There are several capable third party products which manage electronic content from SharePoint 2010 as records within their third party repositories using a variety of approaches.  But, if you want to achieve enterprise-wide content governance and records management within SharePoint, what do you need to do?  There are two categories of add-on capabilities that are required. 

Compliance Requirements –These requirements extend and enhance the records management capabilities of SharePoint 2010 to perform the traditional records management functions required for DoD 5015.2 or MoReq 2010 certification without requiring a separate enterprise content management or records management repository.  These standards serve as proxy definitions of the required capabilities for enterprise records management in large organizations, although very few non-government organizations are truly required to be compliant with these standards.  (I anticipate that an initial effect of SharePoint 2010 certification by one of these standards groups will be an interesting question to ask the vendors who say that SharePoint is not an appropriate records management repository: “What part of certification do you not believe in?”)

Governance Requirements –It is not enough that some of an organization’s SharePoint sites are well governed, because many of the questions and risks will focus on the ungoverned sites.  Governance requirements include policy, process and automation to ensure that all of the SharePoint sites in an organization consistently support the compliance requirements.  Governance features enforce consistency and drive the user adoption of SharePoint through an information lifecycle and transparent information governance.

Compliance Requirements

The following compliance and records management requirements can be satisfied through SharePoint add-on products, the extension of SharePoint frameworks, or via customization, depending on the time and budget available to your organization. 

File Plan Management – A file plan is a hierarchical structure that organizes records into a structure whereby rules for disposition and review can be cohesively applied.  Using this file plan, users can place records into a category or folder (generically called a node) that corresponds to the type of record.  Rules associated with a node in the file plan define specific actions and behaviors to be applied to records filed in that node.  A folder is a construct representing the node.  File plan management provides a user interface for the definition of specific attributes and levels of the file plan structure.  File plan management should also include the ability to push the structure into a set of SharePoint constructs such as sites, libraries, and folders.  In addition, the associated actions and behaviors should also be able to be pushed into appropriate SharePoint constructs such as workflows and information management policies.  This is required if an organization has hundreds or thousands of nodes in their file plan because otherwise the administration of records categorization requirements and their management across a SharePoint architecture becomes unwieldy. 

Records Administration – These are features, unique to record management, that enable users, record managers and administrators to create, move, copy, administer, and dispose of records adhering to the unique processes and requirements dictated by record management best practices.  These features relate to the specific processes required to perform actions requested by users within the constraints of their applications.  Below are several examples of records administration process requirements:

Vital Records – This includes specific functionality that addresses those records that have been identified as critical or “vital” to the organization.  These capabilities include the ability to identify, track and systematically review these records and their designation.  Many organizations have requirements for Vital Records and SharePoint has no native capabilities to support Vital Records without add-ons or customization. 

Cut-off and Disposition Processing – Cut-off is the point at which a record begins the execution of the associated retention schedule.  Typically, a cut-off is a set of criteria that must be met prior to the action of processing the associated retention schedule policy.  The required capabilities include setting the scheduled cut-off review process periods, specifying and managing the cut-off event relationships and their execution, and performing the associated pre and post reporting functions.

Transfers – The Transfer function provides the ability to export selected records into a specified output format.  In addition, records also need to be imported into SharePoint through Transfer capabilities.  The import and export functionality provided through the Transfer function should also include the ability to extend the input and output formats and to map specific record attributes to these formats. 

Record Relationships – This provides the ability to create bi-directional, parent-child and peer-to-peer relationships between two or more records.  Relationships provide the ability to maintain connectivity between associated records as well as the ability to enumerate superseding and supporting record information. 

Event Management – Event management is the ability to define an occurrence of an activity that initiates an action on a record, such as setting the cut-off date.  Event management provides the ability to define and manage the events associated with the initiation of the retention schedule actions of a record.  These events may be defined as single events (e.g. sale of an asset, termination of employee) or recurring (e.g. contract review and renewal).  SharePoint has the ability to process a retention policy based on a metadata value on the record and therefore can process a disposition policy once the specific metadata value has been set (such as an event date).  What isn’t manifested in SharePoint is a consistent manner to handle this event date and the process of triggering the date on hundreds or thousands of records.

Remote Blob Storage and Digital Shredding – Binary Large Object (BLOB) storage in SharePoint consumes a considerable amount of a SQL Server's resources.  Remote BLOB storage for records management allows clients to move the BLOB content to an external storage layer, resulting in improved performance and lower cost.  It also enables assured destruction through certified digital shredding of content at final disposition.  This is a records management requirement in many jurisdictions that is not easily implemented within Microsoft SQL Server.  Several SharePoint ecosystem providers provide products with various levels of support for these requirements. 

Governance Requirements 

These features support the consistent provisioning of sites and establish metadata and information policy rules that enable the incorporation and enforcement of an information lifecycle, thereby reducing or eliminating end user involvement in the classification process.

Governance Provisioning – Governance provisioning provides the ability for farm administrators to work with their governance teams to pre-define a set of provisioning definitions for new sites in the SharePoint farm.  A provisioning definition includes pre-configured settings for items such as:

• Site URL standards
• Site Naming Standards
• Features Activated/Deactivated
• Library and List creation
• Content Type Assignment (lists and libraries)
• Default user/group assignments
• Requirements for Site Creation approval

Site provisioning is used by site collection administrators or site owners to request and configure new sites within prescribed site governance and configuration parameters.  Site provisioning might also limit the ability of local administrators to override the enterprise governance and configuration parameters.  Site provisioning features are critical to the deployment and maintenance of SharePoint sites with consistent and enforceable governance built in.  (It should be noted that SharePoint 2010 has come a long way in providing this capability through the ability to define sites, export them as templates that can be subsequently used to provision new sites.) 

Metadata Rules and Inheritance – Metadata rules and inheritance are used to define global and local rules for how properties and metadata are automatically set, defaulted and defined for a given content type or location.  SharePoint 2010 provides the ability to default property values based on document library or folder.  Metadata rules and inheritance extend this capability through the ability to define specific default value rules for a specific column, within a content type deployed throughout the SharePoint farm.  In addition, local rules may be defined to provide specific rules at a site, sub-site, document library or folder level.  These rules may simply provide a default value or comprehensively enforce a standard value based on a given content type or location.  Metadata rules and inheritance capabilities ensure that a single site column defined for your enterprise can enforce specific context-sensitive values depending on usage or location.  This enables SharePoint content governance to be achieved while minimizing the requirements for user data entry in the process of content classification. 

Content Organizer Management - Content Organizer management allows for centralized control over content routing rules across multiple sites, site collections and farms, instantiates changes to rules from a central source and eliminates the need to manage content organizer settings and rules across numerous sites.  This is critical in organizations with hundreds or thousands of SharePoint sites because it makes the overall process of leveraging the standard SharePoint Content Organizer capabilities more manageable. 

In combination, these high level requirements establish the basis for a consistent SharePoint 2010 platform for content governance and records management in large organizations.  This will enable these organizations to ensure that all of their content and documents in SharePoint are managed in a manner consistent with legal and regulatory requirements.  Even if content is migrated outside of SharePoint in its lifecycle, we believe that addressing most of these requirements within SharePoint is consistent with industry best practices.