A record is a type of information, typically a document, that requires structured retention and management to support either internally defined or externally mandated regulatory requirements . Records management encompasses the process and resources to properly handle the declaration, undeclaration, and removed of materials at the appropriate points in their lifecycles. Records management in SharePoint is used for the following:
Uploading materials to be stored and tracked as records.
Identifying when items managed through the environment are to be classified and managed as records.
Determining how long records are to be maintained.
Archiving and disposing of materials based on defined disposition rules.
Several capabilities are available in SharePoint to manage these aspects of records management. Records management capabilities in SharePoint include the following:
Content organizer, which is used to collect and organize materials.
Record retention rules, which define declaration, undeclaration, and removal rules for materials.
Record centers, which store and organize records.
Holds created to identify items that need to be retained or exported based on the outcome of external events (typically litigation).
Document deletion policies created to delete materials based on organizational content disposal requirements.
Data loss prevention (DLP) policies used to help protect sensitive organizational content.
Understanding Records Management
Before the technical tools in SharePoint that support record retention and management are discussed, you need to become familiar with the elements of records management and with the planning to be done to prepare for managing records within your SharePoint environment, including how to manage materials identified by the organization for proactive control, planning for reacting to content retention, or hold, needs to address situational information retention requirements, especially litigation or audit events, and finally for managing the expiration of content.
Proactive Records Management Planning
Before you can take advantage of the SharePoint records management features, you need to define your requirements for managing records, including how these features are to be applied to the content managed in SharePoint. This planning should include the following:
Identifying finalized materials to be uploaded to SharePoint for retention and access purposes.
Identifying materials to be developed in SharePoint and matured as records.
Defining records retention rights.
Determining retention rules records are to adhere to.
Defining content consumption approaches for the material.
Defining content archival and expiration rules and approaches.
Identify Records
The first step in records management planning is identifying materials in the environment that are to be managed as records. To determine the materials to be managed (such as contracts, standard operating procedures, product specifications, and so on) and decide whether these materials are to be developed in the environment or added to it after they are created and are ready for maintenance as records. For each type of item, define the following:
The method to be used to bring the content into the environment. This will be some combination of the following:
Uploading the materials in their completed state to store them for retention and consumption.
Uploading materials that are to be further developed in the environment and retained as records later in their lifecycle.
Creating new materials and managing their entire lifecycle in the SharePoint environment, including eventual retention as records.
The details about the items to be tracked. They should include a combination of fields to manage records retention, as well as fields to support targeted searching and content organization requirements. For example, a field needed to manage retention might include an effective date for a contract if retention rules leverage that date to determine when the document should be declared as a record.
Security of items at each point in the lifecycle. As materials mature, security may need to be updated to reflect changes to their access. For example, when a proposal document is being developed, sales representatives might have rights to edit it. But once finalized and distributed, it might become read-only for them to protect it from alteration after distribution.
How content is consumed by site users, including organization for browsing and viewing and availability through search. Just as document security may change over time, how documents are exposed to the organization may also change. For example, a contract in development might be seen only by navigating to the library where it exists. But when finalized and executed, the contract might join other executed agreements in being viewable and searchable.
Plan for the archival and deletion of content. Determines content that should be moved to an archive location at some point in its lifecycle and determine content that should be subject to standard content deletion plans.
With this information identified, you can determine the record management capabilities required to support the organization’s records management needs.
Planning for Content Holds
Unlike records retention processes, which are proactively configured and managed, content holds occur as reactions to events, such as litigation events, that require identification and retention of materials related to a specific topic or activity. Since information retention needs cannot be predetermined, this is a reactionary process, one based on each situation’s specific needs. Pre-hold planning can help streamline information discovery and optimize content to make locating it easier based on details most likely to relate to content hold needs. Taking the following planning steps will help you prepare for content holds:
Identify the most likely scenarios for which content holds will be needed.
Specify content attributes that represent the details most likely to be used to identify materials needed to support expected hold scenarios. If, for example, you expect to need content holds for product materials, ensure that items associated with a specific product are easy to identify by tracking the product or products an item relates to as part of its properties.
Adding Content with Content Organizer
Adding documents to SharePoint libraries, including methods that support uploading single items and multiple items all at once into an environment, is discussed in Chapter 7. One characteristic of all the methods is that the individual doing the upload has to know where the document must be placed to become available. But at times you will not want to rely on users in the environment to place items in appropriate locations or want items placed in their final store until a specific person or group in the organization reviews them. You might want the records management department, for example, to review a contract before the rest of the organization sees it.
Content organizer is used to allow materials to be uploaded into a single library, called a Drop Off library. These materials are then automatically routed to a final storage location based on the item’s properties when uploaded. Content organizer is an alternative to constructing workflow processes when you want to control routing of documents added to SharePoint. It lets you manage duplicate document uploading and simple document review requirements prior to materials being made generally available.
Enabling Content Organizer
Content organizer must be enabled in a site before it can be used. Record center sites (discussed later in the chapter) have this feature activated by default. However, all other sites require it be enabled . To enable content organizer in a site, do the following:
Navigate to the site where you want to enable content organizer.
On the site’s home page, select the Site Settings option from the Settings menu.
On the Site Settings page, click the Manage Site Features option from the Site Actions section.
On the Site Features page, click the Activate button for the Content Organizer feature.
With the content organizer feature activated, a Drop Off library is created, and content organizer management capabilities are added.
Configuring Content Organizer
Once content organizer features are active in a site, you can configure its services to identify how content added to the site is handled. To configure content organizer in a site where the feature is enabled, do the following:
Navigate to the site where content organizer is enabled.
On the site’s home page, select the Site Settings option from the Settings Menu.
On the Site Settings page, select the Content Organizer Settings option from the Site Administration section.
On the Content Organizer Settings page (see Figure 10-1), do as follows:
Figure 10-1. Content Organizer Settings page
In the Redirect Users to the Drop Off Library section, identify whether to redirect users of libraries listed as content organizer destinations to the Drop Off library when they upload content.
In the Sending to Another Site section, identify whether content organizer rules can route documents to libraries in a different site.
In the Folder Partitioning section, identify whether to create new folders to route content to once the folder currently in use contains a specified number of files. As part of configuring this option, also specify the number of items to allow before routing to a new folder and the format to use for naming new folders that are created.
In the Duplicate Submissions section, identify the approach for handling an uploaded file with the same name as an existing item in the destination location. You can choose to upload the file as a new version of the existing file or to append unique characters to the uploaded file’s name to store it as a new item in the library.
In the Preserving Context section, identify whether audit log and property details are to be kept with the document as it is routed to its identified final storage location.
In the Rule Manager section, specify who can create content organizer rules and whether such individuals are to get e-mail notifications when items submitted do not meet defined rules or when content is left in the Drop Off library for a designated number of days.
Click the OK button to save the content organizer configuration .
The overall configuration of the content organizer is saved, and content organizer is ready to have content organizer rules configured.
Configuring Content Organizer Rules
Content organizer rules govern movement of content from the site’s Drop Off library to other locations in the current site or in another SharePoint site. To create content organizer rules in a site, do as follows:
Navigate to the site where content organizer rules need to be configured.
On the site’s home page, select the Site Settings option from the Settings menu.
On the Site Settings page, select the Content Organizer Rules option from the Site Administration section.
On the Content Organizer Rules page, click the New Item option to create a new content organizer rule.
On the New Rule page (see Figure 10-2), do the following:
Figure 10-2. New Rule page
In the Rule Name section, enter the name for the new content organizer rule.
In the Rule Status and Priority section, identify whether the rule is active and, if active, the rule’s priority level. Inactive rules are not used to route content. The priority determines the importance of the rule. If more than one rule will impact a document, the rule with the highest priority is applied to the item.
In the Submission’s Content Type section, do the following:
Identify the content type for the rule to act on by selecting the Group the content type is categorized under. Then select the content type.
Specify whether the content type has alternate names and, if it does, what they are. To specify alternate names, enter them in the Add Alternate Name box, and click the Add button to place the name in the List of Alternate Names section.
In the Conditions section, identify the conditions under which to execute the rule. This includes identifying the property values that will make the item meet the rule’s conditions.
In the Target Location section, identify the library to which to move the items meeting the rule and whether to place the items in folders. You can specify the property to base the folder name on and whether the name is to include the name of the property, its value, or both.
Click the OK button to save the rule.
The rule is created and will be applied to content added to the Drop Off library. You can add other rules to support content routing. To edit them on the Content Organizer Rules page , select the appropriate rule and then the Edit Item option from the Items ribbon tab.
Using Content Organizer
With rules in place, you can leverage content organizer to route materials based on the configured rules. To do this, follow these steps:
Upload items into the Drop Off library. Items added to the Drop Off library will be processed by the content organizer, which will identify the rule or rules that apply to the item being added.
If no rules apply, the document is left in the Drop Off library. If content organizer was configured to send e-mail notifications to rule managers, the e-mail indicates that a document has been added to which no rules apply.
If a single rule applies, that rule is executed and routes the document to the appropriate location.
If multiple rules apply , the rule with the highest priority is applied to the document. If multiple rules with equal priority apply, the first rule with that priority is applied to the document.
In working with content organizer, you may create rules that require information to be edited prior to routing the document to a final location. For example, if you allow people to upload contracts but want your legal department to review them before they are routed to the Contracts library, set the rule to run on the Contract content type when a Status field is set to Approved. Legal can access documents in the Drop Off library and update the Status field to Approved. Editing the Status field value then triggers the associated rule and moves the document to the library.
Managing Records
Whether you want to upload content to be saved as records or manage the development of materials that have reached the point in the lifecycle where they should be declared as records, you can manage the entire process of creating and maintaining records in SharePoint. Materials can be identified as records and locked from modification or removal, routed to different locations as they mature, and eventually be deleted to remove them from the environment. The management of overall record declaration and management settings within a site collection is configured at the site collection level. It can then be refined within specific lists and libraries.
Managing Site Collection Records Declaration Settings
Overall records management settings are configurable for a site collection when the In-Place Records Management site collection feature is activated. In-Place Records Management allows management of records in any list or library in a site collection. Once this feature is activated, record management options become available, and you can configure records management capabilities. These options define the default settings for declaring records in the site’s lists and libraries. The settings determine the level of restrictions placed on items declared records, including whether to allow their editing or deletion . The settings are also used to determine whether manual record declaration can be performed and what rights levels users need to manually declare and undeclare records. To manage a SharePoint site collection’s record declaration settings, do the following:
Navigate to the root site in the site collection.
On the home page of the site, select the Site Settings option from the Settings menu.
On the Site Settings page, select the Record Declaration Settings option from the Site Collection Administration section.
On the Record Declaration Settings page (see Figure 10-3), do as follows:
In the Record Restrictions section, from the following options select access restrictions to associate with documents locked as records:
No Additional Restrictions: Records will have the same access capabilities as standard items. With this option selected, a record can be edited or deleted like any other SharePoint item.
Block Delete: Items declared as records cannot be deleted. With this option selected, records can only be edited. To delete an item declared a record, first undeclare it, then delete it.
Block Edit and Delete: The default option for records. With this option selected, once an item is declared a record, it cannot be edited or deleted. To change a record, first undeclare it, then make the change.
In the Record Declaration Availability section, identify whether the ability to manually declare records is available by default in the site collection’s lists and libraries.
In the Declaration Roles section , identify the rights users need to declare and undeclare records. Set independently, these options let you require different rights levels for each activity. With both options configured, security levels available for selection are as follows:
All list contributors and administrators: The default for record declaration settings, this option specifies that the action can be performed by any individual having at least Contribute rights to the list or library.
Only list administrators: The default for undeclaring records, this option specifies that only individuals with Administrative rights to the list or library can perform the activity.
Only policy actions: Select this option when you do not want to allow any user, regardless of security rights, to declare or undeclare records. With this option selected, only information management policy processes can perform the action.
Once the record declaration settings are appropriately configured , click the OK button to save the settings.
Figure 10-3. Record Declaration Settings page
The settings are saved and applied to your entire site collection. You are returned to the Site Settings page.
Managing List and Library Record Declaration Settings
We have discussed how you can define records declaration settings for your overall site collection that impact all lists and libraries in the SharePoint site collection. Many times, however, you will want to be more granular in configuring these capabilities and define only specific locations where manual records management is allowed. You can do this by configuring the record declaration settings for a list or library. These settings let you override the configuration settings defined at the site collection level for a specific list or library. You can determine whether to declare records in the selected list or library and identify whether items added to that location are automatically declared as records. To configure a list’s or library’s record declaration settings , do the following:
Navigate to the list or library where you want to manage record declaration settings.
On the list or library view page, select the List/Library Settings option from the List/Library ribbon tab.
On the Settings page, select the Record Declaration Settings option from the Permissions and Management section.
On the Library Record Declaration Settings page (see Figure 10-4), select the following:
Figure 10-4. Library Record Declaration Settings page
In the Manual Record Declaration Availability section, specify whether to make manual records declaration available in the list or library. Select from the following options:
Use the site collection default settings: The default for all lists and libraries, this option bases the ability to manually manage records on the records management settings configured for the site collection itself (configuring the site collection’s record declaration settings is discussed earlier in the chapter).
Always allow the manual declaration of records: With this option selected, users can manually declare records in the list or library. Security levels required to declare and undeclare actions are based on the selections made in the site collection’s record declaration settings.
Never allow the manual declaration of records: With this option selected, list or library users are not permitted to declare records in that list or library. Only information management retention policies and workflow processes are able to declare and undeclare records in this location.
In the Automatic Declaration section, identify whether new items added to the list or library are automatically declared as records.
Once the record declaration settings for the list or library are configured, click the OK button.
The record declaration settings are saved and applied to the list or library. You are returned to the settings page for the list or library.
Manual Records Declaration
As discussed earlier in this chapter, site collection and list or library records declaration settings are used to establish whether records can be manually declared and undeclared in lists and libraries. At times you will want to enable individuals to manually declare records. For example, your process may not be well enough defined to create automated retention rules, or you may have a group in your organization that is responsible for reviewing and classifying items before they are declared records.
To manually declare records within a list or library where manual records declaration settings are enabled, do the following:
Navigate to the list or library where you want to manually declare an item a record.
On the list or library view page, select the Compliance Details option from the list item’s context menu or the document’s hover panel menu.
In the Compliance Details window (see Figure 10-5), click the Declare as a Record option in the Record Status section.
Figure 10-5. Compliance Details window
In the confirmation window, click the OK button to confirm that the item is declared a record.
The Compliance Details window is updated to show the Record Status as Record. Click the Close button to return to the list or library view.
The list or library view is updated to indicate the item is locked as a record (the lock indicator is added to the file’s icon, as Figure 10-6 shows). The file also becomes subject to the defined records management restrictions discussed earlier in this chapter.
Figure 10-6. File locked as a record
To manually undeclare an item that is currently declared a record, do the following:
Navigate to the list or library where you want to undeclare an item a record.
On the list or library view page, select the Compliance Details option from the list item’s context menu or the document’s hover panel menu.
On the Compliance Details window (see Figure 10-5), click the Undeclare Record option in the Record Status section.
In the confirmation window, click the OK button to confirm that the item is undeclared a record.
The Compliance Details window is updated to show the record status as Not a Record. Click the Close button to return to the list or library view.
The item is no longer considered a record, and all record management restrictions are removed from the item.
Managing Records through Record Retention Rules
Record retention rules are defined as part of information management policies configured to automatically declare and undeclare items as records based on an item’s properties. These rules allow you to define record declaration and undeclaration settings as part of an item’s lifecycle . This section covers how to configure retention policies to automatically declare and undeclare records (how to configure information management policies to address document retention and auditing needs is discussed in Chapter 9).
You might want to automatically manage declaration and undeclaration of records when you have materials that have a defined lifecycle and need protection to ensure they are not removed or edited once they reach a specific point in their development. For example, these rules may apply in managing contracts. You may have a corporate policy requiring copies of executed contracts to be maintained in the environment from the time they are made effective, the effective date, until ten years after they are no longer in effect—the termination date. To support this policy, you can create an information management procedure that declares a document a record on the effective date, moves the item to an archive location on the termination date, and then deletes the item ten years after the termination date.
Configuring Retention Policies
Retention policies are configured within information management policies, which include a set of rules organized into stages, each representing a lifecycle stage of an item. The stages are defined by property values of the item. To create a retention policy, first identify the details by which the policy stages are to be defined and then the action to be taken when an item reaches that stage. To support the contract management example, let’s configure a retention policy similar to the one detailed in Table 10-1.
Table 10-1. Contract Management Retention Policy Example
Stage Description | Event | Action | Recurrence |
|---|---|---|---|
Contract Effective | Effective Date + 0 Years | Declare Record | No |
Contract Terminated | Termination Date + 0 Years | Transfer to Another Location | No |
10 Years after Contract Terminated | Termination Date + 10 Years | Permanently Delete | No |
To configure a retention policy, do the following:
Navigate to the list or library where you want to configure the retention policy.
On the list or library view page, select the List/Library Settings option from the List/Library ribbon tab.
On the Settings page, select the Information Management Policy Settings option from the Permissions and Management section.
On the Information Management Policy Settings page, select the content type or library settings option to navigate to the Edit Policy page for the appropriate item (editing content type and library policies are discussed in Chapter 9).
On the Edit Policy page, do the following:
In the Retention section, select the Enable Retention option.
With the Enable Retention option selected, the Add a Retention Stage link appears. Click the link to open the Stage Properties window, where you can define the details for the records retention stage.
In the Stage Properties window (see Figure 10-7), enter the following information:
Figure 10-7. Stage Properties window
In the Event section, identify a date property to use for that stage of the item and a date offset value to identify when the policy stage is to take effect. For the contract management example discussed earlier in this section, identify a stage as Effective Date + 0 years to create a stage to take effect on the defined effective date. Alternatively in this section, choose a custom retention formula (formulas are configured in your SharePoint environment by a SharePoint technical administrator). If none are present, this option is disabled.
In the Action section, identify the activity that is to occur when the item enters the stage. In our contract’s effective date example, have the Declare Record option declare the item a record when the effective date is reached. Actions available for selection include the following:
Move to Recycle Bin: The item is deleted from the list or library, much as items are deleted manually. The item becomes subject to the recycle bin management rules.
Permanently Delete: The item is deleted from the list or library. Since it is not placed in the recycle bin, it is unavailable for restoration.
Transfer to Another Location: This option moves the item to a registered destination location in SharePoint. It requires configuring the location as a registered destination (how to do this is discussed in Chapter 10).
Start a Workflow: An identified workflow is started when the configured event occurs against the item.
Skip to Next Stage: This option causes the information management policy to transition to the next defined stage. The associated item is not changed in any way.
Declare Record: This option locks the item as a record. It requires you to enable the In Place Records Management site collection feature in the site collection.
Delete Previous Drafts: Any previous draft versions stored in its version history are deleted, leaving only published versions.
Delete All Previous Versions: All previous versions of the item stored in its version history are deleted, leaving only the current version.
Note To declare items as records as part of a policy, enable the in-place records site collection feature. If this feature is not enabled, the Declare Record option is not available for selection.
In the Recurrence section, identify whether to repeat the assigned action for the item while it is in the stage and, if it is repeated, how frequently. The option to repeat the action within a stage is not available for all actions.
Once the details for the stage are configured, click the OK button.
Once all of the retention stages are properly defined, click the OK button to save the policy.
The information management policy is saved, and the defined retention policy is applied to the list or library.
Viewing Item Retention Stage Details
When you configure a retention policy to impact an item in a list or library, you can view the item’s status to understand the stages the item has passed through, the stage it is in, and the stages it has not entered. This information appears in the Compliance Details window (see Figure 10-5).
Record Centers
As was discussed in Chapter 2, the Record Center site template creates sites designed to store and manage records (see Figure 10-8). These sites contain many items we have previously discussed, such as content organizer, preconfigured within the site. Additional menu options and management pages to help you manage these resources are also made available. Use record centers when you want to create a site that can collect and manage company records.
Figure 10-8. Record center site
Configuring Record Center Sites
Sites created from the Record Center template need to be configured to support the types of documents to be managed within them. The configuration activities that need to be performed within this type of site include creating and adding content types representing documents supported by the record center to the Drop Off library and to created record libraries. (Creating and managing content types are discussed in detail in Chapter 9.) For example, if you intend to use the record center site to manage contracts, you must create one or more content types with the proper column details to support the contract documents that are to be managed in the site and then associate the content types with the Drop Off library so that this type of file can be uploaded to the site.
Another part of configuring a record center site is creating record repository libraries. These libraries act as the final storage locations for content routed to the site. You will need to create one or more of these libraries depending on your document storage and organization requirements. To continue with the contracts example, you might decide to add only a single record repository, called Contracts, in which to store all contract documents routed to the site. Alternatively, you might create a second record repository library, called Classified Contracts, with restricted security for storing employment agreements and other types of highly confidential contracts. Any record repository libraries must be configured with the content types representing the materials they will be used to manage.
Note
The same content types used in the repository libraries to store documents should also be used in the Drop Off library to support uploading of the documents. The Drop Off library ought to contain the content types used in all of the record repository libraries in the site.
With the libraries where content is to be managed configured, you will need to create content organizer rules to route documents from the Drop Off library to the appropriate record repository libraries (how to create and manage these rules is discussed earlier in this chapter). Create the rules in record center sites to control routing of documents to the appropriate repository libraries. Within the Settings menu, these sites have an additional option (see Figure 10-9) that navigates you to the Record Center Management page.
Figure 10-9. Settings menu in a record center site
The Record Center Management page is provided to list the steps necessary to configure the site. The page provides instructions on how to manage the details discussed so far, as well as to provide access to the Create and Manage Content Organizer Rules options. You can initiate the creation of a new content organizer rule or select an existing rule to be edited within the provided Content Organizer Rules view in the same way as you can access and manage these rules by selecting the Content Organizer options from the Site Settings page (discussed in the "Content Organizer" section).
To configure record center sites, you also need to create record retention policies that will determine documents’ lifecycles and manage any record declaration requirements needed for the items routed to the library.
Managing Documents in Record Center Sites
Once record center sites are configured, you can manage the collection and retention of documents in these sites. Documents can be uploaded to record center sites using any of the standard document upload options discussed in Chapter 7, such as navigating to the Drop Off library and choosing the New Document option or selecting the Upload Document option from the Files menu. A record center, however, also includes a Submit a Record button on its home page. The button can be clicked to initiate the upload of a new document.
A new document uploaded to a record center site is listed in the My Records Pending Submission section until routed to its final retention library. Items listed in this section (as well as how long they are listed there) depend on defined content organizer rules and on whether any manual steps have to be performed on them before they can be routed to their final storage libraries.
Site administrators of record center sites can tailor these sites’ layout as needed to reflect their purposes and objectives.
Document Centers
Document center sites (see Figure 10-10) are designed to store and manage corporate documents. While record center sites (discussed earlier) include the resources necessary to automatically route materials to document libraries based on the document properties using content organizer, document center sites are the better choice when the goal is to have users upload documents directly into a document repository library, where they are expected to stay rather than be routed elsewhere.
Figure 10-10. Document center sites
When created, a document center site includes a single document library, called Documents, where uploaded materials are expected to reside. The site also includes a task list. Its purpose is to track activities related to the stored documents that need to be performed. As items are added to the library, they appear in the two library views listed on the document center’s home page.
Newest Documents: This view lists those documents most recently added to the library, in descending order by the Created date.
Modified by Me: This view lists the documents in the library most recently modified by the user viewing the site.
The document center site’s home page also includes an Upload a Document button. It can be used to initiate the upload of a document into the site’s Documents library.
Document center sites , like others in SharePoint, support records management policies allowing materials in them to be subject to structured management processes. Manual records declaration can also be configured in these sites to support content retention requirements.
Content Holds
A content hold is used to identify content and suspend its expiration or deletion by users or expiration policies. Holds can be created in sites where the Hold feature is active. Placing a hold in this way is called a local hold. By default record centers have the Hold feature enabled to support creation of local holds, whereas other sites need this feature activated to support local content holds. Holds can also be created within eDiscovery center portals. These portals, created with the eDiscovery center site collection template, are specifically designed to support the creation of cross-environment content holds that can be used to identify and hold content all across SharePoint, as well as from Microsoft Exchange mailboxes. (We discuss eDiscovery centers later in this chapter.)
Local Holds
Local holds are used to create locally managed content holds in the site where the content resides. They are useful when all of the content needing to be held is located within a single site. Local holds can be created in any site where the Hold site feature is activated. To activate the Hold site feature , do the following:
Navigate to the site where you want to activate the Hold feature.
On the site’s home page, select the Site Settings option from the Settings menu.
On the Site Settings page, select the Manage Site Features option from the Site Actions section.
On the Site Features page, click the Activate button for the Hold feature.
With the Hold feature activated, local hold functionality is available in the site.
Creating Local Holds
To create a hold in a site whose Hold feature is activated, do as follows:
Navigate to the site where you want to create the local hold.
On the site’s home page, select the Site Settings option from the Settings menu.
On the Site Settings page, select the Holds option from the Hold section.
On the Holds page, select the New Item option from the Items ribbon tab.
On the Item Edit page, do the following:
Enter a name for the hold.
Enter an optional description for the hold.
Enter the optional Managed By information used to identify the individual responsible for managing the hold.
Click the Save button.
The new hold is created in the site.
Adding Items to Local Holds Individually
Once a local hold is created, you can identify items to be managed by the hold. Items added to the hold are restricted from being removed from the environment manually or with information management policies or workflows. To add an item to an existing hold, do the following:
Navigate to the list or library containing the item to be added to the hold.
On the list or library view page, select the Compliance Details option from the list item’s context menu or the document’s hover panel menu.
In the Compliance Details window, select the Add/Remove from Hold option from the Hold Status section.
On the Item Hold Status screen, do the following:
Click the Add to a Hold option and select the hold to place the item in.
Enter an optional comment for the hold of the item. The comment will be included in the audit log for the hold.
Click the Save button to save the hold of the item.
The item is added to the selected hold and locked so that it cannot be edited or deleted.
Adding Items to Local Holds Through Search
Picking individual documents to add to holds assumes you know which documents contain the information that triggers placement of the item in the hold. Often, however, you will not know all of the documents to include in a hold, nor will you be able to select them individually without reading through each item to determine whether it should be placed in the hold. In such a case, you can use search to locate the items to be added to the hold. To use search to identify items to add to a hold, do the following:
Navigate to the site where content needs to be held.
On the site’s home page, select the Site Settings option from the Settings menu.
On the Site Settings page, click the Discover and Hold Content option from the Hold section.
On the Search and Add to Hold page, do the following:
In the Search Criteria section, enter terms to use to locate content through search and add it to the hold. Select the Preview Results option to view a list of items located by using the entered terms.
In the Local Hold or Export section, identify how to handle items matching the criteria. Selecting the Keep in Place and Add to Hold Directly option adds items located by the search to the specified hold. Selecting Copy to Another Location and Add the Copy to a Hold creates copies of the identified items, placing them in the hold, and leaving the original documents untouched. If you select this option, also select a destination location to which to copy the items.
In the Relevant Hold section, identify the hold to place the located items in, or choose to create a new hold. Creating a new hold opens the New Hold window (discussed in the "Create Local Holds" section of this chapter).
Click the Add Results to Hold button to add the located items to the selected hold.
On the confirmation screen for adding the request to the scheduled process, click the OK button.
The hold request is submitted to the scheduled process tasked with adding the items to the hold. The process searches for and locates the items and adds them to the hold.
Removing Items from a Local Hold
Items added to a local hold can later be removed from the hold and returned to their previous state, where they can be managed by information management policies, by workflows, and manually. To remove an item from a local hold, do the following:
Navigate to the list or library containing the item to be removed from the hold.
On the list or library view page, select the Compliance Details option from the list item’s context menu or the document’s hover panel menu.
In the Compliance Details window, select the Add/Remove from Hold option from the Hold Status section.
On the Item Hold Status screen, do the following:
Select the Remove from Hold option, and choose the hold from which the item is to be removed.
Optionally enter a comment for the item’s removal from the hold. The comment is included in the audit log for the hold.
Click the Save button to save the removal of the item from the hold.
Once the item is removed from the hold, the restrictions placed on it are released.
Viewing All Items in a Hold
To view the list of items placed in a local hold, do the following:
Navigate to the site where you want to view the details of a local hold.
On the site’s home page, select the Site Settings option from the Settings menu.
On the Site Settings page, select the Hold Reports option from the Hold section.
On the Hold Reports page, click the name of the hold report to view.
The selected hold report is opened and can be reviewed.
Viewing All Holds Associated with an Item
We have discussed how to view all the items associated with a specific hold. To view all the holds associated with a specific item, do as follows:
Navigate to the list or library containing the item whose hold you want to view.
On the list or library view page, select the Compliance Details option from the list item’s context menu or the document’s hover panel menu.
In the Compliance Details window, select the Add/Remove from Hold option from the Hold Status section.
Select the Remove from Hold drop-down list to see all of the holds associated with the item.
You can view the holds associated with the item and, if necessary, remove the item from a listed hold, as described in the "Remove an Item from a Local Hold" section in this chapter.
eDiscovery Center Holds
In addition to the local holds discussed so far in this chapter, SharePoint 2016 includes an eDiscovery center portal template that can be used to create eDiscovery center sites (see Figure 10-11). (The elements included in the eDiscovery center sites are discussed in Chapter 2.)
Figure 10-11. eDiscovery center site
eDiscovery centers are site collections that include capabilities to create and manage content holds spanning the entire SharePoint environment and Microsoft Exchange mailboxes. eDiscovery centers are organized with the following structure to create and manage holds:
Cases: Subsites created in the eDiscovery center used to create and organize holds associated with a specific event.
eDiscovery Sets: Specify the content sources from which the hold will locate content to be included and filters to be applied to identify the content.
Queries: Identify the search criteria used to select hold content to be reviewed and exported.
Exports: Identify extracts of the held content to be used to provide materials to appropriate parties.
Creating Cases
A case, used to identify and organize content holds, is a site created to store holds associated with a specific event, typically a litigation event. Cases are created from the eDiscovery center home page as follows:
Navigate to the home of the eDiscovery center site.
On the site home page, select the Create New Case option.
On the New SharePoint Site page, do the following:
In the Title and Description section, enter the title for the new case site and an optional description.
In the Web Site Address section, enter the URL for the new site.
In the Template section, leave the eDiscovery Case site selected.
In the Permissions section, identify whether the case site is to inherit permissions from the parent site or use unique permissions.
In the Navigation section, select whether the site is to be listed in the Quick Launch of the eDiscovery center root site.
In the Navigation Inheritance section, specify whether to inherit the navigation bar from the parent site or create one unique to the case site.
Click the Create button.
The new case site is created, and you are taken to the home page of the new site (see Figure 10-12).
Figure 10-12. Case site
Creating eDiscovery Sets
Once a case is created, you can store holds in the case site by creating eDiscovery sets that define the characteristics of content to be included in the hold. To create an eDiscovery set, do the following:
Navigate to the case site where the eDiscovery set is to be created.
On the Case home page in the Identify and Hold section, select the New Item in the eDiscovery sets.
On the New: eDiscovery Set page, do the following:
In the eDiscovery Set Name section, enter a name for the new eDiscovery set.
In the Sources section, click Add & Manage Sources, and, on the Sources page, select the mailboxes and sites to use as sources for the content search. Then click the OK button. Continue to add sources until all sources of content are identified.
In the Filter section, specify the criteria for identifying content to contain within the hold. Criteria should include some combination of the following elements. Then click the Apply Filter option.
Filter: Identifies text to be used to perform the search.
Start Date: Limits the items returned to those dated on or after the entered date.
End Date: Limits the items returned to those dated on or before the entered date.
Author/Sender: Limits content to items created by or mail messages sent by the selected person.
Domain: Limits content returned to include only items from a specific domain.
In the In-Place Hold section, identify whether to place the hold on the items in place, so that they are held in the location where they are currently saved, or to place the hold on the items by copying them to a different destination location.
Click the Save button.
The eDiscovery set is added to the case.
Creating Queries
Queries are created to locate content from the eDiscovery set to be included in an export or view. To create a query, do the following:
Navigate to the case site where you want to create the query.
On the Case home page, select the New Item option from the Queries in the Search and Export section.
On the Query: New Item page, do the following:
In the Name section, enter a name for the query.
In the Query section, identify the query filters, including the following:
Query Terms: Identifying search terms to be used to locate content.
Start Date: Limiting items returned to those dated on or after the entered date.
End Date: Limiting items returned to those dated on or before the entered date.
Author/Sender: Limiting content to items created by or mail messages sent by the selected person.
Select the Advanced Query Options link to show the Advanced Query Options window, where advanced query properties can be entered. Then click the OK button to save the entered options.
In the Sources section, select Modify Query Source to change the source details to include all case content identified, only content in specific eDiscovery sets, or content only in specific sources.
On the Exchange tab, identify whether to limit items only to specific types of Exchange messages.
On the SharePoint tab, identify whether to limit the query only to files of certain types and limit items by any additional properties.
Click the Save button to save the query details.
The query is created and saved to the case.
Exports
After queries are created, you can export query items to copy them for reference or to share them with other parties. To export the content referenced by a query, do the following:
Navigate to the case home page containing the query to export content from.
In the Queries list of the Search and Export section, click the name of the query to export content from.
In the Query window, click the Export button.
In the Export window, do the following:
In the Options section, identify whether to remove duplicate content when querying content in Exchange and whether to include versions of a document and encrypted content or content with unknown formats.
Click the OK button.
On the Export: Download page, select whether to download the resulting items or download a report of the items by clicking the Download Results or Download Report option.
If prompted to do so with the Application Run Security Warning window, click the Run button.
In the eDiscovery Download Manager app window, specify where to save the downloaded files to or where to create the report file. Then click the OK button.
Once the file download is completed, click the Close button on the eDiscovery Download Manager app window.
The eDiscovery Download Manager app closes, and the files or reports become available in the selected download location .
In-Place Hold Policy Center
So far, we discussed how holds can be created against content in a site to ensure content is not changed or deleted to react to content retention needs, such as litigation support. In-place hold policies, see Figure 10-13, are designed to combine the content retention concepts of records management with the search-based content identification and grouping performed by eDiscovery centers to allow for the creation of rules that can return content based on attributes of the materials.
Figure 10-13. In-place hold policy center site
Creating In-Place Hold Policies
As discussed in Chapter 2, in-place hold policy centers need to be created by a SharePoint technical administrator. Once an In-place hold policy center is available in-place hold policies can be created to manage the retention of content. To create an in-place hold, do the following:
Navigate to the In-Place Hold Policy Center home site.
Click the New Item option from the Manage In-Place Hold Policies section.
On the Time Based In-Place Hold page, shown in Figure 10-14, do the following:
Figure 10-14. New: Time Based In-Place Hold page
In the In-Place Hold Policy Name section, enter a name for the new policy.
In the Sources section, click the Add & Manage Sources option to identify the site URLs that will be subject to the hold. On the displayed Add & Manage Sources screen, do the following:
Enter the URLs for the sites to include in the hold and then select the Check Location option to validate the location.
Once all locations are added, click the OK button.
In the Filter section, enter the filter criteria that will be used to identify the content to be included in the hold. You can select the Search Syntax and Tips link to help understand how to create filter criteria. The Get Statistics option can then be clicked to understand the content that currently aligns with the entered filter criteria.
In the In-Place Hold section, identify the length for the hold in Years, Months, or Days and whether the hold will be based on the Create Date or Modified Date of the items included in the hold.
The Preview Results button can be clicked to view the results of the hold based on the currently available content and the rules defined.
Once all the details have been entered and verified, click the Save button.
Compliance Policy Center
Our focus so far in this chapter has been on retaining resources either proactively to address corporate records retention or to react to situations, such as litigation events, that require saving content specific to the situation. In this section, we shift our focus to removing content based on content expiration rules and identifying content that violates data protection policies and must be moved or removed.
Content expiration and data loss prevention policies are defined within compliance policy centers. Compliance policy centers are a specific type of site collections that must be created by a SharePoint technical administrator; see Figure 10-15. We discussed the overall layout and structure of these sites in Chapter 2.
Figure 10-15. Compliance policy center home page
Deletion Policies
Deletion policies are defined to remove content from SharePoint following a company’s content expiration policies. For example, you may want to ensure that news is removed no longer than two years after it has been published.
To create a deletion policy, do the following:
Navigate to the In-Place Hold Policy Center home page.
On the Compliance Policy Center home page, select the Deletion Policies link.
On the Document Deletion Policy Center page, select the Deletion Policies link.
On the Deletion Policies page, see Figure 10-16, click the New Item link.
Figure 10-16. Document deletion policy center page
On the New: Deletion Policy page, do the following:
Enter the name for the policy.
Enter an optional description for the policy.
Create rules for the policy by selecting New in the Rules for This Policy section and then, on the New Deletion Rule page, do the following:
Enter the name for the deletion rule.
In the Delete Action section, specify if items should be moved to the recycle bin or be permanently deleted.
For the Date From When the Document Deletion Date Will Be Calculated, choose Last Modified or Created Date.
Enter the number of years, months, or days after the selected date that the item should be deleted.
Identify if the rule will be the default rule for the policy.
Select the Save option.
Select the Save option.
The deletion policyPolicy is saved and you are returned to the Deletion Policies page.
Assigning Deletion Policies to Site Templates
Deletion policies can be associated with site templates so that when sites are created from those site templates the deletion policy will be automatically applied to the created site.
To assign a deletion policy to a site template, do the following:
Navigate to the In-Place Hold Policy Center home page.
On the Compliance Policy Center home page, select the Deletion Policies link.
On the Document Deletion Policy Center page, select the Policy Assignments for Templates link.
On the Policy Assignments for Templates page click the New Item link.
On the New: Template Assignment page, do the following:
In the Template section, select the First Choose a Template link and then, on the Choose a Template screen, select the template to associate the policy to and click the Save button.
In the Assigned Policies section, select the policy to assign to the template.
Click the Save button.
The policy is assigned to the template.
Assigning Deletion Policies to Site Collections
Deletion policies can be associated to site templates and available site collections. When this is done the policies assigned override any associated to the site template. To assign a policy to a site collection, do the following:
Navigate to the In-Place Hold Policy Center home page.
On the Compliance Policy Center home page, select the Deletion Policies link.
On the Document Deletion Policy Center page, click the Policy Assignments for Site Collection link.
On the Policy Assignments for Site Collections page, click the New Item link.
On the New: Site Collection Assignment page, do the following:
In the Site Collection section, click the First Choose a Site Collection link and, on the Choose a Site Collection screen, select the site collection to apply the policy to and click the Save button.
In the Assigned Policies section, select the policy to assign to the site collection.
Click the Save button.
The policy is assigned to the site collection and you are returned to the Deletion Policy page.
Data Loss Prevention Policies
Data loss prevention (DLP) policies are put in place to protect sensitive data from being inappropriately stored and shared. For example, you may want to ensure that social security numbers or credit card numbers are not saved in documents and lists of certain site collections. DLP policies create reports identifying content that is in violation of the assigned DLP policies .
Creating Data Loss Prevention Policies
Data loss prevention policies are created by doing the following:
Navigate to the In-Place Hold Policy Center home page.
On the Compliance Policy Center home page, select the Data Loss Prevention Policies link.
On the Data Loss Prevention Policy Center page, click the Data Loss Prevention Policies link (see Figure 10-17).
Figure 10-17. Data loss prevention policy center page
On the Data Loss Prevention Policy page, click the New link.
On the New DLP Policy screen, do the following:
Enter a name for the policy.
Select the template that defines the type of information you want to locate.
Enter the number of instances of a match to require an item to be included in the DLP report.
Identify the e-mail address for the incident report to be sent to.
Identify if a policy tip should be sent to the user.
Click the Save button.
The DLP policy is saved and you are returned to the Data Loss Prevention Policy page.
Applying Data Loss Prevention Policies to Site Collections
Data loss prevention policies are assigned to site collections where they are applied. Once applied, they will then take effect. To apply a data loss prevention policy to a site collection, do the following:
Navigate to the In-Place Hold Policy Center home page.
On the Compliance Policy Center home page, select the Data Loss Prevention Policies link.
On the Data Loss Prevention Policy Center page, click the Policy Assignments for Site Collections link.
On the Data Loss Prevention Policy Assignment page, click the New Item link
On the New: Site Collection Assignment page, do the following:
In the Site Collection section, click the First Choose a Site Collection link. On the Choose a Site Collection screen, enter the URL for the site collection and click the Save button.
In the Assigned Policies section, select the policy to apply to the site collection.
Click the Save button.
The DLP policy is applied to the site collection .
Summary
In this chapter, we reviewed the resources SharePoint includes to help manage records. We discussed how content organizer is used to automatically organize content added to SharePoint sites based on predefined content management rules. We then discussed how to create and manage records to protect content from being altered or deleted and looked at how record centers can be used to centrally manage company records. We then shifted our conversation to document centers, which allow for the management of large volumes of documents providing more flexibility related to content structure and placement. We then discussed content holds and how they can be added in-place against the content where it is managed or through eDiscovery centers to retain materials. Lastly, we introduced in-place policy centers and compliance policy centers. We showed how in-place hold policy centers are used to manage time-based content holds and how compliance centers are used to manage the automated deletion of content based on business rules and how they can be used to report on violations of data loss prevention (DLP) rules .
In the next chapter, we will focus our discussion on SharePoint Search capabilities, looking at how search can be configured and leveraged for content discovery and display.