The Role of Microsoft SharePoint in a Records Management Strategy. A Docula bs Wh i te Pa pe r

Transcription

1 The Role of Microsoft SharePoint in a Records Management Strategy A Docula bs Wh i te Pa pe r

2 2009 Doculabs, 200 West Monroe Street, Suite 2050, Chicago, IL (312) Reproduction in whole or in part without written permission is prohibited. Doculabs is a registered trademark. All other vendor and product names are assumed to be trade and service marks of their respective companies.

3 Table of Contents 1. Introduction pg How to make SharePoint an Asset pg Why SharePoint Should be Part of pg. 3-4 Your Records Management Strategy 4. Using SharePoint in Your Records Management Strategy pg Summary pg About Doculabs pg. 9

4 Risk Introduction No question: Microsoft Office SharePoint Server (SharePoint) provides organizations an effective tool for getting a greater volume of their information under corporate management. It also takes on one of the major records management challenges facing organizations today: how to provide basic content and retention services for their electronically stored information (ESI) information in the form of documents that may be of indeterminate value and risk to the organization, but which nonetheless require management. And for many organizations, this information represents the bulk of their ESI. Where does SharePoint fit as part of a corporate records management strategy? How can you make the most effective use of the SharePoint product as part of your own organization s records management strategy? In this white paper, Doculabs outlines a range of options that will allow you to leverage SharePoint s considerable strengths its basic content and retention services while also finding ways to provide the robust lifecycle management capabilities that certain portions of your ESI require. Declared Records Include in Future Scope Current Records Management Scope Current RM strategy and tactics proactively concerned about regulated and clearly business critical records(contracts, Financial Documents, Policies, Procedures), but is reactive in regards to management of other business related information which isn t regulated or obviously vital Likely Discoverable Information Current RM strategy and tactics reactive in regards to management of other business related information (Work-inprocess, drafts, voic s, notes) which isn t regulated or obviously vital Other Business-related Information Electronically Stored Information Future RM work to encourage better, consistent management of other business related information to improve offensive business tactics (e.g. sales, service) which will help reduce reactive and costly activities for audit, compliance and litigation response Non-business Information Manageability Page 1

5 How to Make SharePoint an Asset F or many organizations, Microsoft SharePoint is an asset simply on the basis of the collaboration, document management, and search capabilities it provides for managing unstructured information capabilities that many organizations previously were not able to roll out to all of their users. From a records management standpoint, SharePoint thus takes on a challenge that previously was not effectively addressable: how to provide basic content and retention services for an organization s electronically stored information (ESI). While content management, records management, and compliance efforts have understandably focused on managing the organization s high-value and high-risk information, the bulk of an organization s ESI is difficult to manage, as well as being of indeterminate value and indeterminate risk. But it still needs to be managed. Although on a per-document basis it may represent a lower grade of value and risk, as a whole, when not appropriately managed, it represents as much or more risk to the organization as the high-value information. Most of the ESI in organizations is not easy to inventory or control, and it may be inventory resistant. That is: The information may be very poorly managed i.e. it may exist in multiple, distributed, unmanaged repositories; it may be stored on local drives, shared drives, in messages or attachments, or in archives; it may not be part of a highly structured process (i.e. not transaction documents or managed by a production workflow). The information is of indeterminate risk to the organization. In many cases it does not include regulated documents and typically is not a proactively declared record or classified as a retention series in the enterprise records plan. In fact, for many organizations, the most significant aspect of ESI in this category is that it s unlikely that any particular item will be requested in discovery, but on the other hand, it s highly likely that some of it will and if it s not managed reasonably well, that will have a significant negative impact on the organization, It s unlikely that any particular item will be requested in discovery, but on the other hand, it s highly likely that some of it will... either because the item is produced and is damaging, or because it cannot be produced, but should have been. Microsoft SharePoint can provide pervasive basic content and retention services for ESI with the above characteristics. As such, the SharePoint product fills a gap that many organizations are just beginning to understand they have: a need for basic content and retention services. The information is of indeterminate value to the organization. It may be in the form of collaboration documents, or multiple drafts and supporting documents. Page 2

6 Why SharePoint Should be Part of Your Records Management Strategy S harepoint is typically deployed to provide repository and library services (e.g. as a replacement for shared drives) and as a common front end for users that need to share documents and collaborate on work-in-progress producing documents that may eventually wind up for lifecycle management in the repository of an enterprise content management (ECM) suite with records management (RM) capabilities. At least initially, SharePoint has been perceived and deployed by many organizations as a solution for departmental use and for userinitiated site creation, with limited IT involvement and historically limited involvement on the part of the Compliance, Legal, or Records Management functions similar to the way that network shared drives and personal archives have met users needs. This approach to content management is largely ungoverned, however, and it is beginning to lead to the following problems: Lack of control over users, resulting in unchecked deployments where users create hundreds of SharePoint workspaces Rapid proliferation of sites and workspaces, with inconsistencies in information categorization and use Users who are unclear about when to store content in Share- Point versus when it should be stored in another repository Questions concerning which repository is the system of record Doculabs recommends developing a governance framework for SharePoint that provides for ongoing management and maintenance of the implementations, as well as the development of policies, procedures, and guidelines for SharePoint usage. Then and only then can an organization take the next step and use SharePoint as a tool to address records management issues and thereby reduce overall risk. But it s also important to note that SharePoint by itself does not adequately provide some of the more complex capabilities required by the corporate records management program, such as a formal retention schedule shared across enterprise one that is court ready (printable and producible during discovery or to prove legal destruction). Nor does SharePoint provide the advanced workflow (with multiple steps and system integration) that s required to manage records lifecycle management and discovery the two primary process types in compliance. Abandoned workspaces, with information retained beyond its usefulness Lack of clearly defined standards or guidelines for content organization or usage, resulting in workspaces that are not easily navigable or searchable Page 3

7 What records management capabilities does SharePoint provide? Repositories in Microsoft Windows SharePoint Services V3 support the following records management-related features (note that features with an asterisk are activated only upon installation of Microsoft Office SharePoint Server 2007): Document retention and expiration policies* Official document-of-record repositories* Workflow process to define expiration Access control and security Information rights management policies applied on download to secure the functional access to documents Tracking and auditing Logging of all actions on sites, content, and workflows Site for storing or archiving enterprise-approved content types In general, we ve found that the limitations of the SharePoint product are in the depth of functionality (compared to advanced ECM products) or its lack of proven scalability. SharePoint falls short not because it can t do X, but rather because it can do X, but not as well as an advanced ECM solution. Specifically, when it comes to records management, SharePoint can deliver records management capabilities, but not as well as advanced ECM solutions with records management components and not without supplementation and expense and even then it may not scale to the enterprise. Bottom line: While SharePoint s records management capabilities have breadth, they lack depth and scalability. Page 4 D

8 Using SharePoint in Your Records Management Strategy F ollowing are a range of potential approaches that Doculabs recommends for using SharePoint as part of your records management strategy, together with Doculabs assessment of the pros and cons of each. The approaches are presented in increasing order of potential benefits and complexity: 1. Deploy SharePoint and another ECM solution with records management capabilities so that they operate relatively independently, with no reliance on SharePoint records management. Under this approach, when an item of work-inprogress has reached the point in its lifecycle where it should be declared a record and should be classified accordingly, it is copied or moved to the enterprise system of record. This step may be either manual (but governed by explicit policies and procedures, and monitored for compliance in practice), or it may be automated to some extent for example, using SharePoint s workflow or records-crawling technology from the ECM/RM solution. Pros: This approach is technologically the quickest, cheapest, and easiest, and while it does depend on having an adequate system of record, it does not depend on SharePoint s RM capabilities, nor does it require any integration between SharePoint and the system of record. It s best for applications where relatively few documents should be rigorously managed records, where a single system of record is desired, and as a first step to the more sophisticated approaches. Cons: The success of this approach often depends on individual employees consistently and accurately taking it upon themselves to play the game typically by copying or moving, declaring, and classifying the document which at many organizations may be a risky venture. 2. Deploy SharePoint and another ECM solution with records management capabilities so that they operate relatively independently, while relying on SharePoint s inherent records management. Under this approach, an organization uses SharePoint s records management component, the Records Center, for relatively basic compliance requirements on items stored within SharePoint. To determine whether Records Center meets your organization s records management needs, the relevant requirement areas to evaluate are primarily whether your requirements are basic in taxonomy (file plan), metadata, retention policies, declaration and classification, hold and release, physical records, audit and reporting, and security. Be sure to assess not only your requirements and whether Share- Point Records Center can address them, but whether it can be done efficiently (for example, whether it would be inefficient, given the volumes of records your organization now has, or expects to have in the future). Other organizational requirements that would preclude the use of SharePoint Records Center are complexity in an organization s taxonomies, lifecycle management requirements, or e- discovery workflows. Records Center is designed primarily to provide records management functionality for content stored in its own repositories, so if you have records in multiple repositories, including other ECM systems, it cannot support a records management program across all the business records in your organization. Page 5

9 Records Center is designed primarily to provide records management functionality for content stored in its own repositories, so if you have records in multiple repositories, including other ECM systems, it cannot support a records management program across all the business records in your organization. Pros: Technologically, this approach is relatively quick, cheap, and not too difficult, and it keeps the recordkeeping of SharePoint documents within a single management system. It s often a good cost and risk, versus benefit approach for collaboration-based ESI or for much of the content usually housed on shared drives. It can also serve as a preliminary step to the more sophisticated approaches. Cons: As indicated above, SharePoint should not be overextended to address complex or enterprise RM requirements or even to address records not managed by SharePoint for non-rm purposes. This approach therefore probably entails multiple recordkeeping systems, each of which must be managed appropriately. 3. Deploy SharePoint and another ECM/records management solution so that they operate relatively independently, while supplementing the records management capabilities of SharePoint with a third-party records management solution. SharePoint Records Center is designed to be replaced by a more comprehensive records management solution without the need for custom development. This approach fills the gaps in SharePoint s inherent ability to address the compliance and efficiency requirements of your organization not by integrating or replacing SharePoint with an advanced ECM/records management solution, but rather by supplementing the records management capabilities of SharePoint by replacing just its records management capabilities, using a third-party product specifically designed for that purpose. Several such third-party products are now on the market, including HP/Meridio or Diagonal Solutions Wisdom product. Pros: This approach addresses many of SharePoint s gaps in RM functionality and scalability, and so provides many of the benefits of the SharePoint-only approach while also offering more sophisticated RM capabilities for those organizations that need them. And for some organizations, it permits the supplemented SharePoint to be the single ECM and rigorous RM solution. Cons: SharePoint (and many of its third-party enhancers) are best for knowledge worker applications and documents (e.g. working with Microsoft Office documents) rather than for process worker applications and documents (e.g. working with production imaging and workflow applications). For this reason, even a supplemented SharePoint approach may be inadequate for those process worker-oriented applications, and therefore will itself require supplementation by another ECM/RM system. The other major limitation to this approach is that of vendor and product risk. Many vendors relevant to this approach are smaller and so may be volatile. Page 6

10 4. Integrate SharePoint and another ECM/records management solution so that the ECM/records management system tracks but does not manage the records that are managed by SharePoint. In this approach, the two systems are loosely coupled and asymmetric, in the sense that the enterprise system of record the other ECM/records management system knows but does not manage the records in SharePoint. The updates may be synchronous, but are usually asynchronous. Pros: This approach allows records managers and other compliance managers to consolidate many (although not all) of the electronic RM functions into a single enterprise system of record. It allows the relevant records to remain within SharePoint without being copied or moved into another system. Finally, it does this without requiring full federated RM, the tighter but more expensive and risky integration between the enterprise RM system and SharePoint. (Federated RM is discussed below as Option 5.) Cons: Perhaps the primary drawback of this approach is that it isn t being aggressively pursued by most ECM/ RM vendors. Instead, they are focusing on federated search and ling (which can only approximate this approach), or on approaches to copy or move records into the enterprise RM system, or on federated RM. 5. Integrate SharePoint and another ECM/records management solution so that the ECM/records management system manages the records in SharePoint. This is the most complex option, requiring a tight connection between the two systems not just for the records management consumer functionality, but also for contributor and coordinator functionalities. It requires the enterprise RM system, the master, to issue commands (to declare, classify, hold, release, retain, destroy) to the SharePoint system that houses the relevant documents. Pros: This approach provides the most centralized RM control over the ESI in SharePoint, while allowing the content to stay in the SharePoint environment. Cons: Many of the ECM/RM vendors have been tantalizing the market with federated RM for years, but have fallen short when it comes to successful implementations. This approach should probably be adopted only after successfully implementing at least one of the simpler approaches described above. Page 7

11 Summary M icrosoft SharePoint can be effectively leveraged as part of an enterprise approach to content and records management, but it requires planning. Irrespective of the approach you take to making SharePoint a part of your approach to records management, Doculabs makes the following recommendations: Develop and implement a governance structure for your ECM and records management programs: Successful implementation of ECM and records management requires an organizational structure to provide the strategy, planning, deployment, review, and support for the rollout of SharePoint, the other ECM solutions, and for the records management program itself. The most effective organizations establish an ECM Center of Excellence or shared services group (including SharePoint and all other ECM solutions deployed within the organization) as well as a records management group both of which report to a steering committee of business and IT management. Develop a taxonomy: To provide effective management of business records in SharePoint and any other ECM system, an organization should develop an enterprise- and department-level taxonomy for all of the repositories in areas where business records are stored. This taxonomy will provide the foundation for document index, folder, and site structures for SharePoint sites, as well as for all ECM repositories that can then be tied to the organization s records classification and retention schedule. Conduct a repository inventory: Considering how SharePoint is commonly rolled out today, it s likely that management has no idea what type of content is being housed in SharePoint sites across the enterprise, let alone whether any of that content consists of business records that require lifecycle management. Conducting a content repository inventory is the way to determine where an organization s high- and medium-risk business records are stored and whether they are currently stored in the appropriate repository whether that repository is a SharePoint site, another ECM repository, a shared drive, or a Lotus Notes database. Page 8

12 About Doculabs Doculabs is a consulting firm that helps organizations develop sound technology strategies for content- and process-related applications. Our engagements focus on helping clients leverage their existing enterprise content management (ECM) investments on a broader enterprise basis through objective analysis and in-depth market knowledge. This approach is based on our fundamental belief that in order to protect a client s long-term interest, technology advisors should not be implementers. 200 West Monroe Street Suite 2050 Chicago, IL (312) Doculabs at: info@doculabs.com Doculabs helps clients deliver on their technology objectives through consulting engagements that address ECM opportunities such as strategic planning, center of excellence creation, taxonomy development, and maturity assessments. Through more than a thousand engagements for organizations facing technology-, compliance-, and process-related challenges, our proven approach has provided our clients the information and advice they need to make confident and well-informed decisions. Hundreds of leading organizations in the Global 2000 and in state and local government have turned to Doculabs for assistance with their technology strategies. For more information about Doculabs, visit our web site at or call (312) Page 9