So why does this development matter to SharePoint records managers?  Admittedly, adoption of cloud-based solutions hasn’t exploded in the manner that so many experts had been predicting.  The same publication that reported the story above also reports that when they asked organizations, ‘What are your company’s plans for cloud computing?’, only 33% of the companies said they were receiving services today from a cloud provider.  This figure is up from 31% last year, but not a particularly high number given that the survey asks only if the company is using cloud computing somewhere within the organization. 

However, the US Federal government – which, for better or worse, tends to be in front of these types of technology trends – is committed to cloud computing and actively promoting it through its ‘Cloud First’ strategy.  And Fortune 500 companies seem to be falling right behind them given my own personal observations.  Add to that the cloud focus that Microsoft is pushing for…well… everything and you have a very compelling argument for developing your own SharePoint cloud-based records management strategy.

You’ll need to apply these Information Management Policies to your Document and Record Libraries both inside and outside of the Records Center.  So here’s a quick look at how you set that up on a Document Library in SharePoint 2010.

First, navigate to the target Library (in this case ‘Maintenance’) and click on the ‘Library’ tab:

From the ribbon, click on ‘Settings’ and select ‘Library Settings’:

Under ‘Permissions and Management’ select ‘Information management policy settings’:

Libraries in SharePoint 2010 default to the Information Management Policy set on its Content Type.  For location based retention and disposition, you will have to override this.  Click on ‘Change source’:

Select ‘Library and Folders’ and click on OK:

(Note: At this point, you may get a message warning that you are overwriting Content Type policies defined by the Site Administrator.  If you get this warning, just ignore it because you always thought the Site Administrator was kind of a jerk who never knew what he was doing, anyway.)

Under ‘Non-Records’, click on ‘Add a retention stage…’: 

Next, select a date from any existing date field in the Content Type to start your retention period.  Then enter the number of days, months or years that the retention period lasts:

Move down and select either an action to take at the end of the retention period or choose to start any workflow the has already been assigned to the Library:

Click ‘OK’ and the Information Management Policy has been assigned to the Library.  (Note: folders in this library will inherit this policy by default unless you specifically break inheritance on the folder.): 

To verify that this policy has been assigned to the content in your Library, navigate to any document in the Library and view its Compliance Details.  This dialog will display the retention policy it is inheriting from the Library:

Obviously, I’m just scratching the surface with Information Management Policies here.  There are a bunch more additional features that I haven’t yet discussed, but I hope to get to them soon.  In the meantime, I hope this is enough to get you started poking around…

First (and most importantly), get yourself a good third-party email management solution that provides the simplest declaration strategy available.  Basically, this means drag-and-drop into a managed Outlook folder and filling out one or two (and no more than three) required metadata properties to help determine the correct record classification into your SharePoint records repository.

Next, work with your Legal Counsel on an acceptable email archiving policy.  This policy should apply throughout your organization to all email, both incoming and outgoing and would be your first line of defense when it comes to email discovery.  (Be sure to thoroughly document how you developed this policy and what data you used to form your decisions.)

Ideally, this policy would require that all emails are stored for one to two years from the day they are sent or received.  If you can get your legal team to agree on less than a year, great.  (Maybe you should have been a lawyer.)  If they want you to store them for more than two years, put the pressure on them to justify the added risk and additional storage costs you are certain to incur.

Though I certainly can’t speak for every organization’s email archiving requirements, I will say that Exchange has some excellent out-of-the-box archiving features that should be suitable for implementing a simple archiving policy like this one.

Finally, work with the propeller-heads in your IT Department to develop two more policies.  The first policy will ensure that email backups are managed in line with the new archiving policy.  For the most part, this means no emails are stored on backup media longer than the standard archiving period.

The second policy would limit the space allocated to your users’ Outlook Inboxes.  This limit would force your users to eventually declare a small number of emails as records and delete any other emails they considered transitory.

I can’t suggest exactly how much space your users should be allocated, everyone’s mileage varies.  But I can suggest you work with your Exchange Administrator and choose an amount you are sure is too low.  Trust me, it’s much easier to start with a number that is too restrictive and increase it as necessary then to have a number that is too high requiring further restrictions. 

And just some final advice.  You can’t possibly document this stuff too much.  Especially from an e-discovery perspective.  And once your email records management policies are set, make every effort to ensure they are implemented and followed.  As I frequently tell my clients, in the eyes of the law, it is much better to have no policy at all than to have a policy that is not enforced.

This is an excellent question that addresses a fundamental understanding of SharePoint records mangement and is vital to a successful solution implementation, so I thought it might be a good idea to post my response here. 

Many retention and disposition requirements (indeed, most retention and disposition requirements at some organizations) are determined by an event rather than the type of record being managed, so a record’s Content Type is usually not enough information to accurately apply the correct Information Management Policy to it. 

This is probably best explained by an example.  Suppose you manage mortgages at a large financial institution.  With each new mortgage a new corresponding folder is created in your records repository.  Over the life of the mortgage, hundreds of records with dozens of different record types – Mortgage Agreements, Property Assessments, etc., etc. – will be added to the folder.  And most (or more likely, all) of these records will have their own Content Type.  Internal corporate policy and outside regulations require that these records are maintained for 10 years after the mortgage is paid off, at which point all the records in the folder, as well as the folder itself, are destroyed. 

From this example – known as case based records retention – it is easy to see why a record’s Content Type alone  wouldn’t provide adequate information for applying the appropriate retention and disposition schedule.  If you were to simply apply a 10-year expiration to, say, all Mortgage Agreement Content Types, SharePoint wouldn’t have any way of knowing when the record’s mortgage was paid off, so it wouldn’t ever trigger the record’s 10 year expiration period.   

This example also explains why the addition of Content Organizer was so critical to successful records management in SharePoint 2010.  Using Content Organizer, we can configure SharePoint to route a record to a folder in the Records Center based on its Content Type (e.g. ‘Mortgage Agreement’) and one or more metadata values (e.g. ‘Mortgage #12345′).  Once the records are properly classified into the correct folder, an Event Date can be applied to all the records it contains upon payoff of the mortgage and the 10 year expiration period can begin in compliance with corporate and external requirements.