Document management and records management: retention, legal holds, Microsoft 365 and costs

Document management vs. records management

In Microsoft's description of a SharePoint document library, people store files, find them, work on them together and reach them from any device. Owners control access to a library, a folder or a single file.^1,2

SharePoint also keeps version history, within limits an admin sets. An admin can set a library to keep 500 major versions with a 365-day expiration. The system then deletes any version older than 365 days.³

Records management starts from evidence. ISO 15489-1:2016 defines a record as information created, received and maintained as evidence and as an asset by an organization or person, in pursuit of legal obligations or in the transaction of business. Its term for what happens at the end is disposition: implementing retention, destruction or transfer decisions documented in disposition authorities.^5,9

US federal law draws the same line. Under 44 U.S.C. 3301, duplicate copies of records kept only for convenience are not records. NARA's records management regulations state that they conform with ISO 15489-1:2001.^10,11

Federal agencies have a deadline behind them. OMB and NARA memo M-23-07 required agencies to manage all permanent records in electronic format by June 30, 2024. NARA's Universal Electronic Records Management Requirements set out the baseline business needs for managing electronic records.^12,13

Retention schedules and legal holds: the rules that apply

A legal hold interrupts routine deletion. The committee note to Rule 37(e) says the prospect of litigation may call for reasonable steps to preserve information by intervening in the routine operation of a system. The same note says the rule does not call for perfection.^20,21

The SEC's audit-trail option is recent. Microsoft's compliance documentation says the amended rule took effect on January 3, 2023, and lets electronic recordkeeping systems meet either the audit-trail requirement or the non-rewriteable, non-erasable one.^15,16,22

SharePoint and Microsoft 365 retention: Purview records management

Microsoft 365 applies retention in two ways. A retention policy sets the same rules for a whole site or mailbox. A retention label sets them on a single folder, document or email, and unlike a policy it travels with the item when it moves within the tenant.^23,24

When rules conflict, retention takes precedence over permanent deletion and the longest retention period wins. If a user edits or deletes a SharePoint or OneDrive file under a retention policy, a copy is kept in the Preservation Hold library.^25,26

Records management in Microsoft Purview builds on those labels:

• Records. A retention label can mark an item as a record, which places restrictions on what users can do with it and logs more activity about it.²⁷
• Regulatory records. Once this label is applied, nobody, not even a global administrator, can remove it. The option is hidden in the label wizard by default.^28,29
• Disposition. Purview supports disposition reviews and proof of records deletion, and maps an organization's retention schedules into retention, declaration and disposition.^30,31
• Preservation Lock. A locked policy cannot be turned off, deleted or made less restrictive, even by a global admin. It is set only through PowerShell.^32,33
• eDiscovery holds. Items under an eDiscovery hold cannot be permanently deleted by any retention policy or label. Microsoft designs these holds for a limited duration, to preserve data for a legal investigation.^34,35

For broker-dealers, Microsoft says Office 365 with Preservation Lock can help meet the SEC 17a-4 immutable storage requirement. It commissioned Cohasset Associates to assess Microsoft 365 against SEC 17a-4, FINRA 4511 and CFTC 1.31.^36,37

Copilot and oversharing: AI reads what users can access

Microsoft Copilot surfaces only the organizational data a user has at least view permission for. Microsoft tells customers to use the Microsoft 365 permission models, such as SharePoint's, so that the right people have the right access.^38,39

Microsoft's deployment blueprint for Copilot has three parts: remediate oversharing, set up guardrails and meet regulations. It says SharePoint Advanced Management is included with a Microsoft Copilot license.^40,41

SharePoint Advanced Management controls named in Microsoft's documentation:

• Reducing unnecessary or unmanaged SharePoint and OneDrive content, which Microsoft says also improves the relevance of Copilot responses.⁴²
• Site attestations, in which owners confirm a site is still needed and check its owners, members, permissions and sharing settings.⁴³
• Restricted access control, which limits a SharePoint or OneDrive site to specific groups.⁴⁴

Enterprise content management platforms and published prices

Google says Workspace data stays in user accounts until a user or admin deletes it, and that Vault retains no data until retention rules are set up. Vault can retain, hold, search and export Workspace data.^45,46,47

Laserfiche, M-Files and Egnyte publish per-user list prices for their document management plans.^48,49,50

For a selection, NARA's Universal ERM Requirements are a public checklist. They cover capture, maintenance and use, disposal, transfer, metadata and reporting, and mark each requirement as Must Have or Should Have.^53,54

Where document and records management goes wrong

• Not preserving messages. The SEC's 2022 cases were for failures by firms and their employees to maintain and preserve electronic communications.⁵⁶
• Keeping everything. The FTC said a hacker in early 2020 went undetected in Blackbaud's networks for three months and removed massive amounts of unencrypted consumer data. Its order requires Blackbaud to delete data it no longer needs.^18,59
• Treating deletion as a cost saving only. Microsoft's Purview documentation says deleting content with no business value also helps manage risk and liability.⁶⁰
• A purge rule nobody tested. Google warns that an improperly set up Vault retention rule can immediately and irreversibly purge data. Data under a legal hold is not purged.^61,62
• Sprawl and oversharing. Copilot can surface whatever a user can view, so unmanaged sites and broad permissions become search results.^38,42