If you are interested in knowing more about Office 365 and all the elements
that come with it, I can recommend signing up to the Microsoft Tech
Community site: https://urldefense.proofpoint.com/v2/url?u=https-3A__techcommunity.microsoft.com_&d=DwIBaQ&c=pZJPUDQ3SB9JplYbifm4nt2lEVG5pWx2KikqINpWlZM&r=b5NZPQUb9_r2rQ3Zd74ATT3aSs9yKyRnJLOhqJvd7fE&m=tvHPaos3Fz_I32k_5Y9LoeV__rom_WYU--J94_vcjro&s=_e_ISoGCALO0uAB6kMLC0d-FuSvd7T1qLSKVAFH9d3M&e=

There don't seem to be many records managers on that site and it would be
good to have your comments and input. For example, there was a recent post
from Microsoft announcing that they would put both security and records
retention 'labels' in the one 'wizard' in the Security and Compliance
portal under the 'Classifications' section.

As we all know, there is (usually) no connection between the security
classification of a record and its retention, so combining them didn't make
sense (which I pointed out, as did a few others). Also, security
classifications are usually visible on a record as 'labels', while records
retention periods are not, so there is usually no requirement to make both
visible, even if they are separated. Microsoft have said they would take
these comments into consideration, but it is really important that records
managers participate and contribute - the Office 365 world continues to
evolve and this is the only way sometimes that Microsoft will get feedback
(and reply to it).

It is also really important that records managers working with Office 365
get as close to the 'core' as possible. It may not be possible to be a
Global Administrator (which is ideal, but requires training), but you
should at the very least be assigned to specific roles and also be the
Service Administrator for the SharePoint/OneDrive areas; this role is
similar to a SharePoint Administrator. The other role you need is a
security role in the Security and Compliance Admin portal, as this will
give you access to the classifications section and allow to monitor
retention and disposal actions.

You should also be (ideally, in my view), the Site Collection Administrator
on every SharePoint site that is created, including the new communication
and Office 365-Group based sites. This ensures (a) you have access to
everything and (b) you can apply controls as required.

At the SharePoint Online level, you may need to re-consider how you manage
records, compared with how you have done it in the past. Organisations
implement SharePoint differently but SharePoint Online is a little
different from its on-premise version and you really need to understand
this difference, and also that SharePoint Online continues to evolve.

   - Some organisations have strong controls (and larger teams to manage
   them) over their (often highly customised) SharePoint environments, with a
   tightly controlled environment where users cannot to do anything but save
   documents. This to me is the old style 'EDRMS' type world.
   - Others have virtually no controls at all, and users can do what they
   want, which can lead (in my opinion) to bit of a messy environment that may
   prove hard to control from a recordkeeping point of view. This is not
   dissimilar to network drive sprawl.
   - In my organisation we sit in the middle of these two 'extremes'. We
   create sites for users but then we hand them over with instructions
   including NOT to customise the site (as this always causes upgrade
   problems). We have a light-touch records management control (2 SP Admins
   for 8,500 staff). We have very limited centrally managed metadata (most of
   it is applied at the site level) and don't use many content types (again,
   limited cases). Users are free to add as many extra metadata columns as
   they like but generally don't; the core metadata columns are usually
   sufficient. We are close to finalising how we implement the new style
   records retention policy 'labels' to records across Exchange, SharePoint
   and OneDrive.

Regarding e-Discovery, records managers should examine how this (and also
Data Loss Prevention) is done in the Office 365 world now as it's different
from the former on-premises environment and works almost entirely based on
content searches.

Andrew Warland
Sydney, Australia

On Fri, Apr 27, 2018 at 5:30 AM, Tina M <[log in to unmask]> wrote:

> As other's stated RIM needs to be on the front lines when using O365.
> From my experience it
> is usually a project team setting up an implementation.  Once implemented
> that project team
> disbands and you really no longer have a point of contact to reach out to
> if changes need to be
> made from a RIM perspective.  So from a RIM point of view you need to make
> sure that you
> document who the Business Contacts are and then implement metadata that
> identifies the
> Business Function of the information, metadata for the information
> lifecycle as well as basic
> metadata needed for eDiscovery.  Then you need to maintain that
> documentation and become
> the documentation Nazi and make sure no changes go through unless they are
> approved by
> RIM.
>
> List archives at http://lists.ufl.edu/archives/recmgmt-l.html
> Contact [log in to unmask] for assistance
> To unsubscribe from this list, click the below link. If not already
> present, place UNSUBSCRIBE RECMGMT-L or UNSUB RECMGMT-L in the body of the
> message.
> mailto:[log in to unmask]
>

List archives at http://lists.ufl.edu/archives/recmgmt-l.html
Contact [log in to unmask] for assistance
To unsubscribe from this list, click the below link. If not already present, place UNSUBSCRIBE RECMGMT-L or UNSUB RECMGMT-L in the body of the message.
mailto:[log in to unmask]