New 2012 Guide! E-Records Institute SharePoint Governance: Leveraging MS SharePoint 2007/2010 for Document Management & Workflow Including Electronic Records Management, E- Discovery, Project Management Issues & More A Comprehensive Management Guide Robert F. Smallwood, MBA IMERGE Consulting Leveraging SharePoint 2007/2010 for DM & Workflow 2012 R. F. Smallwood Do Not Copy 1
Who we are E-Records Institute is a specialized consulting practice of IMERGE Consulting. IMERGE is North America's largest and most experienced team of experts in the broader fields of enterprise content management (ECM) and business process optimization. IMERGE is also a leading provider of education courses in records management, electronic document capture and e-discover. IMERGE has offices in major cities including Boston, San Francisco, Toronto, Chicago, Houston, Los Angeles, Minneapolis, Seattle, New Orleans and Washington, DC. What we have achieved Our track record speaks for itself: We have completed more successful projects, published more articles and given more expert presentations than any other enterprise content management consulting firm in the world. We are proud that our organizations include some of the world s best and largest public and private organizations. Learn more about us at imergeconsult.com or contact an IMERGE professional today to discuss putting our expertise to work for you. About the Author Robert Smallwood, MBA, Master of Information Technology, Laureate of Information Technology is a founding Partner of IMERGE Consulting and has been recognized as one of the industry s 25 Most Influential People and Top 3 Independent Consultants by KM World magazine. Some of his past organizations include Bank of America, AT&T, Xerox and IBM. He has published more than 100 articles and given more than 50 conference presentations on document, records and content management. He is the author of several books including, Safeguarding Critical E-Documents, and, Taming the Email Tiger, and the upcoming books, Managing Electronic Records, Information Governance for Business Documents & Records, to be published by Wiley & Sons. Leveraging SharePoint 2007/2010 for DM & Workflow 2010 R. F. Smallwood Do Not Copy 2
LEVERAGING MS SharePoint 2007/2010 for Document Management & Workflow Table of Contents Executive Summary...5 Document Management...6 SharePoint Governance: First Steps...7 SharePoint: The Panacea for DM?...10 SharePoint Cannot Remedy Poor DM...11 SP2007: Information Management Policies...12 Introduction to Document Management in SharePoint Server 2007...18 SP 2007 Document Center Features...23 Introduction to Workflows in SP 2007...38 Records Management Planning for SP2007...74 How a hold works...79 Create a hold...79 Add records to a hold...79 Search for records to add to a hold...80 View all records on a hold...80 View all holds against a record...80 Remove a record from a hold...81 Release all records from a hold...81 SharePoint 2010: The 10 Most Important Features...82 DM Improvements in SharePoint 2010 vs. 2007...83 Additional SharePoint 2010 Improvements for DM...87 How Document Management Has Evolved in SharePoint 2010...93 More on Document Management in SharePoint 2010...96 Is SharePoint 2010 the Answer for Document Management?...98 Overview of Document Management in SP Server 2010... 102 The Document Management Planning Process for SP2010... 103 Maximizing SP2010 DM-Using Managed Terms and Keywords... 119 DM Components Tips and Tricks... 136 Managing Metadata: In-depth Guidance... 139 Document Security in SP2010... 144 SharePoint 2010 Document Management Libraries... 145 SharePoint 2010 Content Type Hub... 150 The Helpful Compliance Details Dialog... 151 Workflows in SharePoint 2010... 153 InfoPath Forms for Workflows... 153 Workflow Task Forms in Microsoft SharePoint Server 2010... 155 SP2007/2010 for DM & Workflow 2012 R. F. Smallwood Do Not Copy 3
Workflow Task Form Processing... 156 SharePoint 2010 Metadata and Taxonomy Management... 157 Information Lifecycle Model... 160 Electronic Records Management Detailed Definition & ECM Role... 161 Records Management Fundamentals... 163 E-Records Management Summary... 166 New RM Capabilities in SharePoint 2010... 166 Improved RM in SharePoint 2010... 167 How SharePoint 2010 Improves on ERM... 168 ERM Using SharePoint 2010 Records Center... 170 SharePoint 2010 Records Management Capabilities & Changes... 175 How SharePoint 2010 Improves on ERM... 175 SharePoint 2010 Records Management Deficiencies... 178 SharePoint 2010 Records Management Review... 179 DoD 5015.2 Records Management Standard... 179 Is SP2010 5015.2 Certified?... 179 SharePoint 2010 Metadata and Taxonomy Management... 180 Tagging vs. Taxonomy?... 183 In-Place Records Management... 186 Document ID Administration... 188 Managed Metadata Service... 192 Site Collection Auditing... 197 Creating New Site Columns for Content Types in SharePoint 2010... 203 ediscovery... 207 SharePoint Server 2010 ediscovery... 207 The ediscovery Process... 208 Overview of Social Computing in SharePoint 2010... 213 Implementation: MIKE 2.0 Delivery Methodology & SharePoint... 215 Glossary of Terms... 223 4
Executive Summary Document management controls the life cycle of documents in organizations how they are created, reviewed, published, and consumed, and how they are ultimately disposed of or retained. SharePoint 2010 has greatly improved document management features over SharePoint 2007 it seems Microsoft listened to concerns of system administrators, users, and records managers. This report provides rich detail on how to best leverage new SP2010 features in implementing document management and workflow, and also how to administer SP2007 document management, workflow, information policies and more. A well-designed document management system promotes finding and sharing documents easily. It promotes knowledge management and information mining. It helps an organization meet its legal and compliance requirements. It provides features at each stage the document life cycle, from template creation to document authoring, reviewing, publishing, auditing, and ultimately destroying or archiving. SharePoint 2007 was a good starting point, and now SP2010 is a platform that helps organizations accomplish their document management and workflow implementation goals, with support for records management. Document management planning considerations include how content will be organized in document libraries, the metadata to define for each type of content, the workflows that will be required during the content's lifecycle, and the policies to apply to the content. Document management is a subset and component of the broader term of enterprise content management (ECM) and is related to document imaging, workflow, records management and digital asset management. This Comprehensive Management Guide the most complete and current available today will assist document managers, records managers, system administrators, IT managers, compliance managers and others involved in document management, workflow, electronic records and e-discovery implementations using SharePoint 2007/2010 to make intelligent, informed decisions. 5
Document Management DEFINING DOCUMENT MANAGEMENT Document management is a component of ECM. Document management controls the life cycle of documents in organizations how they are created, reviewed, published, and consumed, and how they are ultimately disposed of or retained. An Electronic Document Management System (EDMS or DMS) is software or a suite of programs designed to store and track electronic documents. In more detail, a document management system is used to track and store electronic documents such as word processing and spreadsheet files, digital report files, and scanned images of paper-based documents. Document management is a subset and component of the broader term of enterprise content management (ECM) and is related to document imaging, workflow, records management and digital asset management. A well-designed document management system promotes finding and sharing documents easily. It organizes content in a logical way, and makes it easy to standardize content creation and presentation across an enterprise. It promotes knowledge management and information mining. It helps an organization meet its legal and compliance requirements. It provides features at each stage the document life cycle, from template creation to document authoring, reviewing, publishing, auditing, and ultimately destroying or archiving. 1 According to a survey by Forrester Research, more than 75% of organizations invested in document management in 2011, and this strong trend will continue for the foreseeable future The Elements of a Document Management System An effective document management solution specifies: What types of documents and other content can be created. What templates to use for each type of document. What metadata to provide for each type of document. Where to store documents at each stage of a document s life cycle. How to control access to a document at each stage of its life cycle. How to move documents within the organization as team members contribute to document creation, review, approval, publication, and disposition. What policies to apply to documents so that document-related actions are audited, documents are retained or disposed of properly, and content important to the organization is protected. 6
How documents are converted as they transition from one stage to another during their life cycles. How documents are treated as corporate records, which must be retained according to legal requirements and corporate guidelines. 1 SharePoint Governance: First Steps Like most things in life, An ounce of prevention is worth a pound of cure. In the case of SharePoint deployments for managing content, especially documents and records, organizations can avoid a lot of headaches and future information governance (IG) risks if they invest time and deliberation in planning how they will deploy SharePoint, and what its business objectives are, and then making all the necessary policy decisions before piloting a roll out of the site to users. This planning process necessarily involves consulting with users about their collaboration, business process, document usage and information storage needs. It also may mean including the records and information management (RIM) staff for guidance on crucial records management issues, and legal staff for legal and compliance requirements. Otherwise, users will start creating and storing documents without knowing what rules to follow, or why the rules exist, and they will find their own workarounds to satisfy their unique document management business requirements. Critical to success in most SharePoint deployments is the input and influence of a Business Analyst. For instance, if you restrict file size requirements too much, the users will store them somewhere perhaps unsecured in the cloud. If you do not allow certain file types, and the users need them, they will find a place to store them. And soon you will have all sorts of variations of folder and file systems and scattered documents and records which results in content chaos. This is more than a mess. It is a costly mess, since economically and efficiently retrieving e-documents and records during e-discovery for legal proceedings will be fraught with search and retrieval challenges. There are also regulatory compliance factors that must be incorporated into SharePoint governance decisions for most organizations. Critical to success in most SharePoint deployments is the input and influence of a Business Analyst, and particularly one who is adept at business process management (BPM) and has a solid understanding of taxonomy principles. If they can bring a library science background to the table, so much the better. 1 http://technet.microsoft.com February, 2009 3 Microsoft SharePoint DM White Paper 7
Where DO You Start? First develop a Problem Statement and formulate Business Objectives for the SharePoint deployment. Then align those objectives with your overall Strategic Plan. Start from a high-level, with strategy and corporate governance issues. Develop a Problem Statement so you know what you are trying to accomplish, and then develop measureable, time-constrained Business Objectives so progress and success toward milestones can be measured. Next, be sure to align these objectives with your organization s overall Vision Statement or Strategic Plan. Aligning technology with business considerations is key to a successful SharePoint deployment. Determine the scope of the SharePoint deployment just where are the boundaries of documents and content types you are going to manage? Which documents will be managed by SharePoint? Which are more active and may need to be externalized and managed by a third party solution? What about records management? E-discovery requirements? Which document types are classified as archival and not needed to be actively managed in SharePoint? These are the types of questions you should be asking, not only from an information governance perspective, but also for optimizing future system performance of SharePoint. Better processes and fewer documents mean faster performance when you are in the heat of the business battle. Who s on First? Or, in other words, Who owns the system? And beyond that, who will contribute documents, who will be allowed to view and/or edit documents, and who will manage the deployment of the SharePoint site? Key questions are: Who is the executive sponsor? Who is responsible for completing the initial deployment project? Who is responsible for day-to-day administration of the site? Who defines and sets up document and content types? List values? Who owns the content in the site? Who is responsible for controlling access to the site? For making changes as users roles change or they are terminated? Who will train users? Initially? On an ongoing basis? Roles & Responsibilities Clear roles and their associated responsibilities for contributing to, maintaining and utilizing the content in SharePoint must be established. Some examples of roles are: 8
Site owner or executive sponsor Site member, contributor, visitor System administrator Site collection administrator Content owner or steward Business Analyst Training, education and user support Information Architect Information Governance Committee (perhaps the SP2010 Governance Team is a sub-group of this) What s on Second? Exactly what documents and content will be stored and managed in SharePoint? (And, of that, which documents rise to the level of being records?) If a business record is created then it should be sent to a central records repository to complete its lifecycle according to established records retention and disposition policies. The selection criteria for storing documents in SharePoint must be clear to all users and administrators of the system. They need to know not only what file sizes are allowed, but also what file formats are permitted or prohibited as well as size limits for lists, libraries and the entire site itself. Establish Processes The process of actually creating a SharePoint site (and others after that, if the business demands it) must follow an orderly, managed pattern. The ownership of the site may change in the future, so the process of transferring that ownership or even decommission the site must be established and standardized. Processes for migrating documents into SharePoint and archiving it must be created. Processes for managing documents that are records must be established, that is, creating appropriate retention schedules that meet all internal and external governance and compliance requirements must be established, and defensible disposition policies must be put in writing. When Legal Holds are required, standard processes must be established to produce records requested during e-discovery. These processes must be designed to be as efficient and low-cost as possible. Failing to produce records good records that can be proven to be authentic and unaltered is an absolute requirement. 9
Disposition time after a predictable or specified event. Once the specified event has occurred, then the retention period is applied. Example: "Destroy 3 years after close of case." The record does not start its retention period until after the case is closed -- at that time its folder is cutoff and the retention period (destroy after 3 years) is applied. Transfer Moving records from one location to another, or change of custody, ownership, and/or responsibility for records Unstructured Records Records maintained in network, shared or personal drives such as MS Word, MS Excel, MS Access, PDF, Tiff, etc. ISO 15489 Sources: x ISO 15489: International Standards Organization 15489 Information and Documentation - Records Management x DoD 5015.2: Design Criteria Standard for Electronic Records Management Software Applications - US Department of Defense x ARMA: ARMA International Glossary 3rd edition (www.arma.org) x MoReq: Model Requirements for the management of electronic records. - European Union x Am Heritage:- The American Heritage Dictionary of the English Language i iii iv ii Endnotes v CMS Wire, November, 2009 vi viii ix x xi vii Endnotes xii CMS Wire, November, 2009 xiii 226