IT Enterprise Services. SharePoint. for records management

Transcription

1 IT Enterprise Services SharePoint for records management

2 Sharing the future Using SharePoint 2010 for enterprise-grade records management requirements is fast becoming the de-facto standard a phenomenal rate of adoption has been witnessed in recent years on the back of SharePoint 2010 becoming one of the fastest growing products in Microsoft s history. SharePoint 2010 is a widely adopted collaborative platform for the storage and sharing of information with a range of records management functionalities. Its predecessors typically required a services element and possible integration with external third party products to deliver highend functionality for Records Management (RM) deployments.. SharePoint is attractive to a range of organisations from SMEs or corporate departments looking for a low-cost, entry-level solution, to large enterprises or Public Sector bodies seeking a strategic information management platform. Having evolved over the past decade, SharePoint 2010 is now extended into the cloud (SharePoint Online), a capability that has and will further increase the impact of the product on the market. Microsoft has a clear product development roadmap for SharePoint and this will greatly assist user organisations in making strategic planning decisions. SharePoint 2010 offers powerful records management capabilities that have been much improved and expanded from the 2003 and 2007 versions. SharePoint 2013 has enhanced these further and consequently both versions have become viable and serious corporate and enterprise-grade solutions to be considered and adopted by most organisations. However, there are certain compliance limitations to the out-of the-box offering and these present challenges that need to be overcome for some organisations in order that SharePoint can be fully and confidently applied and leveraged to optimise records management functions. Records management Firstly, what is records management? RM programmes in general are designed to: Ensure that all required records are retained by the organisation Ensure that all records that are required to be retained by statute, regulation, or contract are retained for the appropriate and approved period of time Ensure that all authorised users can access records efficiently Ensure that all records can be read, used and regarded as authentic once located Establish litigation hold procedures to ensure that potentially responsive documents are not destroyed once litigation and/or government investigation is reasonably anticipated Establish procedures to ensure the timely destruction of appropriate information. SharePoint 2010 steps up SharePoint 2010 introduced a host of new tools and features in evolving its 2007 offering including: Content Organiser Document Sets Document IDs Location Based Metadata In-Place Records Management Managed Metadata Metadata Navigation SharePoint 2013 offers expanded functionality and improvements over These provide improved ways to help you protect your organisation. The records archive and in-place record retention from earlier versions of SharePoint Server are still supported. SharePoint Server 2013 adds retention policies that are applied at the level of a site.

3 Addressing the compliance issue Maintaining appropriate and effective records management practices to deliver and meet statutory obligations is a requirement for many corporate and enterprise businesses as well as Public Sector bodies. The records management policy, together with the associated standards, applies to the management of records, in all technical or physical formats or media, created or received by these bodies in the conduct of their business activities. The policy specifically applies to documents (including written and typed documents and annotated copies), computer files (including word processor files, databases, spread sheets and presentations), paper based files, electronic mail messages, workflow, diary records, fax messages, reports, intranet and internet web pages. Records management policy is geared towards compliance with various requirements and standards for records management such as Model Requirements for the Management of Electronic Records (commonly known as MoReq) published in various updates by the European Commission in 2001, 2008 and 2011, TNA 2002 (also known as PRO II, published by The National Archive or TNA formerly called Public Records Office or PRO) and BS ISO Furthermore, legislations such as the Data Protection Act 1998 and Freedom of Information Act 2000 have set out specific requirements in relation to the creation and management of records. Public Sector bodies may be further influenced by a number of other factors, such as Environmental Information Regulations 2004, Criminal Justice Act 1988, Civil Evidence Act 1995, Regulation of Investigatory Powers Act 2000, Human Rights Act 1998, Codes of Practice such as the section 46 Code of Practice on the management of records under the Freedom of Information Act Additional enhancements... In addition to site retention other enhancements include: Drag and drop content into Document Libraries will enhance user adoption. Site Mailboxes - Exchange mailbox and SharePoint interoperability allows users to drag and drop from Outlook into the site s mailbox for everyone to see or drag it into the document library for treatment as a record. Closing the site removes the exchange mailbox. Cloud-ready SharePoint 2013 brings records management functionality previously omitted to the Microsoft Office 365. In Place Records, Record Centres and centralised repositories are all available in Office 365. Social ECM Ability to follow documents enhances document management capabilities. Managed Navigation enables administrators to easily manage navigation across site collections Quick Edit View - allows for better editing and managed metadata on simultaneous multiple files with a better interface. Hover over document preview of search results thumbnail preview of documents Document Sets enable adding One Note and Folders into Document Sets, improving flexibility. There s also the ability to manage the entire document set by sending it to a record centre. ediscovery Centre - SharePoint 2010 improved records discovery with the introduction of in place holds takes it a step further with the introduction of the ediscovery Centre, where you can now manage preservations, search and export across site collections, SharePoint farms and Exchange servers

4 While SharePoint 2010 is generally considered good enough for most business needs - compliance with the many records/ data governance rules and instruments is perceived as an issue, primarily due to the non-compliance of its predecessors (SharePoint 2003/2007). This incorrect perception has, to an extent, been carried through to SharePoint 2010 and is therefore incorrectly regarded as a hurdle to implementing SharePoint for records management.. As with any product, SharePoint 2010 has limitations. However, steps can be taken to plug these limitations in the out-of-the-box product to derive a compliant, highly effective and manageable solution. Whilst the enhancements made to SharePoint 2010 (and SharePoint 2013) address many of the limitations, compliance with TNA 2002 which previously required integration with niche third-party products to enhance standard functionality was never mandated nor sought. The same is true of MoReq2010 compliance. However, MoReq has proved to be a standard too far as, to date, no product has been certified against Moreq2010 despite many vendors openly supporting the MoReq2010 initiative. Many organisations have successfully implemented SharePoint 2010 as their records management system, without any additional enhancements through customisations and/or integration to niche products. SharePoint 2010 (and 2013) has evolved significantly with respect to records management functionality. The TNA assessment of SharePoint 2010 as a records management solution highlights three key findings of possible non-compliance: 1. Without the use of third party solutions, government departments implementing SP2010 out-of-the-box risk noncompliance with the Lord Chancellor s Code of Practice on the management of records issued under section 46 of the Freedom of Information Act 2000 (s46). The first point of this review indicates that an out-of-thebox SharePoint solution may not meet the requirements of section 46 of the FOIA This however does not imply a duplication of SharePoint s comparatively enhanced functionality by implementing a standalone solution. In fact, it is important to highlight that a Code of Practice only recommends and does not mandate any requirements. It is useful however, to understand the possible non-compliance scenarios if business process alternatives are not implemented. The second point highlights the fact that business requirements for records management should be clearly understood and documented, prior to implementation. SharePoint is about end user empowerment and therefore any implementation must include representation from the end users that it impacts. It is therefore crucial that organisation s identify their requirements and have the option to find alternatives that avoids any customisation to the base SharePoint 2010 or 2013 product suite. If, however, a business process mandates customisation or use third party tools, then there are tools available that are kept aligned to the latest SharePoint releases. The gap between SharePoint 2010/13 and a TNA 2002 compliant solution has narrowed significantly such that records management requirements can be addressed cost effectively by extending SharePoint with the necessary features, rather than duplication through a standalone records management solution. A single solution would also negate the need for additional third-party licenses. 2. Failure to identify business requirements for records management prior to implementation could significantly affect the usability, uptake and support of SP Given the broad nature of SP2010 s service offering, an implementation should involve Records and Information Managers, ICT and Information Assurance functions as well as business users.

5 The Capita advantage With SharePoint 2013 already available, organisations should investigate the possibility of adopting SharePoint 2013 for their records management needs. The product s many features and benefits provide a highly scalable, flexible and cost-effective solution. SharePoint offers a starting point for organisations experiencing content management for the first time - compatibility with other SharePoint services, Microsoft products together with a progressive evolutionary roadmap point to its continued adoption across organisations and usecases. Capita is well positioned to guide your organisation through this process to enable the most suitable configuration options and module development, to deliver a compliant SharePoint 2013 records management solution implementation. Where higher levels of customisation or integration with third-party tools are required Capita can provide the necessary expertise and know-how from many previous similar executions. Capita would also recommend a clearly articulated migration strategy for existing SharePoint users to SharePoint 2013, whilst making full use of the opportunity to introduce specific business process changes that make the best use of the latest technologies as well as functional enhancements. Any compliance shortcomings should, in the first instance, be addressed through business process alternatives or minor customisations of the out-of-the-box (OOB) SharePoint 2013 solution. In order to recommend optimal alternatives (in preference to any customisation), Capita offers the services of Hybrid Analysts who are SharePoint technical experts with a track record in business analysis. These analysts are fully aware of SharePoint features and therefore able to offer alternatives whilst gathering business requirements. These options are designed to maximise the product s OOB recordkeeping features and employ customisation as a last resort to compensate for any gaps that may exist between what SharePoint delivers OOB and your recordkeeping requirements. Why Capita IT Enterprise Services? Author: Rana Ghosh-Roy, Ph.D. Head of Analytics and Information Management, Capita IT Enterprise Services Capita we understand business, technology and process and we bring them together with people to deliver better business results. This is how we apply technology better. Working with Capita you will find that we: Think of you - our customer. We make it our business to see the world through your eyes and provide efficient, innovative data centre services that you deserve. Find a way - our entrepreneurial spirit and know how enables us to deliver cost-effective, agile, productive data centre services that can be trusted. Keep it simple - we minimise the risk and deliver results fast. Our expertise means we are practical, pragmatic and we deliver on time. Want to learn more? Visit or contact us on ites@capita.co.uk