Selecting the Right Tools for Records Management

Microsoft’s SharePoint is becoming ubiquitous. If it isn’t in your organization yet, it most likely will be soon. There are several beneficial reasons for this from an infrastructure and architecture standpoint. But, as a records and information management (RIM) professional, you will – if you haven’t already – receive that call: “Can’t we use SharePoint to manage our records?”

Take a deep breath before you answer.

Brent Gatewood, CRM

Bookmark and Share

What SharePoint Is – and Is Not

To answer that question, it’s important to look at what SharePoint is and what it isn’t. SharePoint started its life as a team site tool for collaboration purposes. Today’s SharePoint (MOSS 2007) is a much-improved offering but still has its focus on collaboration. The SharePoint Portal Server was first released in 2001, and there have been two significant (full-version) updates in just six years. Obviously, Microsoft is dedicating resources to the development of the SharePoint family. A careful look at SharePoint’s overview and capabilities as listed by Microsoft on the SharePoint website ( shows:

"Office SharePoint Server 2007 is an integrated suite of server capabilities that can help improve organizational effectiveness by providing comprehensive content management and enterprise search, accelerating shared business processes, and facilitating information sharing across boundaries for better business insight."

And on SharePoint’s capabilities site (

"Microsoft Office SharePoint Server 2007 provides a single, integrated location where employees can efficiently collaborate with team members, find organizational resources, search for experts and corporate information, manage content and workflow, and leverage business insight to make better-informed decisions."

From the records management perspective, there is something missing from the references above – any mention of records or lifecycle management. The focus is on collaboration and presentation, not control and disposition.

What DoD 5015.2 Certification Means

The above information illustrates that SharePoint was not intended as a records management tool. It was, however, certified as compliant with DoD 5015.2-STD Electronic Records Management Software Applications Design Criteria Standard in May of 2007. This Department of Defense (DoD) standard is generally considered the baseline for functionality concerning records management software and was developed specifically for the certification of records management applications to be deployed in DoD (and, ultimately, most government) settings. In the absence of any other standard in the U.S. marketplace, the DoD spec has become the de facto standard for commercial implementations of records management software as well.

The SharePoint certification and general availability of the DoD 5015.2 Resource Kit (an add-on enabling functionality required for DoD compliance) seem to indicate that Microsoft is indeed promoting SharePoint for records management. The question is: Can a solid records management solution be put together by adding the DoD Resource Kit to a standard MOSS 2007 installation?

Unfortunately, the answer is “no,” as the company states on its own Microsoft Records Management Team Blog ( ):

"… the Resource Kit is not intended for customers, who would like to enhance the records management functionality of MOSS 2007 with particular 5015.2-oriented features but are not required to run their system in a certified configuration.


The DoD 5015.2 Resource Kit is intended only [emphasis added] for customers, who are required to run their records management system in a DoD 5015.2 Chapter 2-certified state."

It is clear, then, that despite its DoD certification, SharePoint alone will not solve an organization’s records management challenges.

RM Benefits & Challenges

SharePoint is gaining wide acceptance for a number of reasons, but one of the most prevalent is its ability to help control file shares or network shares. Organizations have historically favored the use of shared drive space on the network allocated to individuals or departments for the storage of unstructured data. On the network, base-level access can be controlled, and the information can be backed up and restored as needed. However, there are typically few controls in place, and data tends to age, gets abandoned, and ultimately is forgotten.

Cheaper storage meant it was easier to store information than to manage it, and this was the model for many years. But, this has resulted in a proliferation of unused and abandoned shared files and directories, with accompanying system capacity and legal discovery problems. Now that organizational risk is being assigned to much of this information, the need for effective lifecycle management of these forgotten repositories has taken on a higher priority.

The appeal of SharePoint is its ability to help manage unstructured data and documents. In SharePoint, users can associate metadata, create portals, grant or deny access, and even build interfaces with other applications. SharePoint has a familiar user interface to Microsoft Office users and can be deployed, generally, with minimal training for the end user. This offers users more tools and organization than they had before, but is it really managing the data? Or, is it simply moving the issues from the file share to SharePoint itself?

Here are some associated records management challenges for consideration, as well as recommendations for
meeting them:

Managing Hard-Copy Information

Every organization has hard-copy information that must be managed. In most organizations, that information lives in a variety of locations and repositories and likely travels from user to user, and repository to repository, depending on its usefulness and lifecycle requirements. Ultimately, a large percentage of record material ends up being stored offsite at a third-party provider. This information must be managed according to the retention schedule and is subject to exception management (for example, for legal holds and audit inquiries). Efficient identification and tracking of this information through its lifecycle is generally required for compliance with the organization’s policies.

Issue and Recommendation: SharePoint was not designed for managing hard-copy records and their disposition. To manage these records, Microsoft recommends in its Records Management Guide for Microsoft Office SharePoint Server that users build lists of hard-copy collections inside SharePoint libraries so metadata can then be assigned to list items. A custom template must be built to capture consistent metadata across the many lists that an organization will likely have.

Controlling the data input and structure is critical to finding information later. A fully vetted process for this must be developed, identifying required taxonomies and list ownership, as unclear standards could result in information being kept in multiple locations with differing retentions or inconsistent naming conventions. Also, without a clear ownership structure, searching multiple lists for information may be problematic. Access to the information must be controlled because every group or department has information that others cannot, or need not, access.

All access and security, as well as the integrations to organization-specific taxonomies and retention schedules, must be built in-house or with the help of a third-party integrator because this functionality is not resident in SharePoint. Using the list function also limits reporting functionality and will likely require additional customization to generate a responsive query structure and needed reports. This will add to the overall complexity of the implementation and may affect user adoption.

Managing Data Outside SharePoint

Every organization has information in repositories that cannot be moved simply for the sake of records management. The repositories that house the information may exist because they were specifically designed for that type of information (engineering documentation control systems, for example) or because security necessitates a separate and controlled repository.

Issue and Recommendation: Out of the box, SharePoint can manage only the information that is contained within its repository. The information outside of SharePoint must still be managed according to the organization’s RIM policies, retention schedule, and exception management requirements. Federated management (centralized control of disparate collections) allows for a central tool set to manage multiple repositories, and currently SharePoint cannot “federate” its management to external repositories. Focusing only on SharePoint will, therefore, create silos of information that create risk for the organization.

As a practical matter, silos of information will occur in most organizations – the goal is to minimize the effort and tool sets required to manage them. But, because SharePoint cannot at present manage this information, its effective lifecycle management will be dependent upon the development of additional controls and acquisition and deployment of additional technology to ensure that these non-SharePoint records are not left behind or abandoned. All this takes time and money in addition to that spent on the SharePoint deployment.

Managing Structured Data

Many large companies have enterprise resource planning (ERP) systems in place to manage multiple facets of their business. The information contained in these systems is diverse, voluminous, and subject to the retention requirements and associated RIM policies of the organization. Managing this information is a challenge in the best of scenarios.

Issue and Recommendation: Some leading content and records management software companies are exploring different methods for managing this information. SharePoint, however, does not currently have integration for ERP systems. This creates yet another silo of information that must be managed with an additional process and/or application.

The above issues make clear that any use of SharePoint for records management requires substantial customization, as well as third-party tools, to fully manage records.

SharePoint Is Here to Stay

SharePoint is not going away. It’s going to become a greater part of most organizations’ daily workings and their user interfaces. Many content and records management vendors are realizing this and are building tight integrations with SharePoint. In fact, there are currently four vendors certified to the DoD standard with SharePoint integrations, and many others have non-certified integrations.

This shows that the marketplace has realized that SharePoint is here to stay, and it is eager to take advantage of the user interface and to leverage the SharePoint installation base. This is a win-win for the end users, as they get a familiar user interface in SharePoint and a robust feature and functionality set from a proven enterprise records management solution.

But to return to the original question, “Can’t we use SharePoint to manage our records?” As shown in the sidebar below shows, SharePoint can help some organizations manage their records. But most organizations need much more robust tools to execute their long-term RIM strategies.

There have been sophisticated and novel approaches to using SharePoint for records management, but these approaches have focused on developing solutions inside the SharePoint framework, ignoring all other information. These approaches do not capitalize on the strengths of, or even necessarily acknowledge the need for, additional records management software.

The upfront development costs associated with these SharePoint solutions can equal – or in many cases exceed – the cost of acquiring and deploying a proven and certified records management solution that can integrate with SharePoint. It also means that records maintained outside the SharePoint environment are not being systematically managed.

The bottom line is that SharePoint was not designed for records management. It was modified to support some aspects of records management. It can be modified even further to perform more records management functions – but most organizations will not likely be able to justify the substantial investment needed to turn it into a tool that is robust enough for effective enterprise records management.

So, get as much as you can from SharePoint. However, plan your records management strategy carefully to create the best records management solution for your organization.


Sidebar: SharePoint and Lifecycle Information Management

An organization must evaluate its infrastructure, data sets, and information lifecycle management needs before it can determine whether SharePoint can help manage its information throughout its lifecycle.

SharePoint can help manage records throughout the lifecycle if the organization:

  • Does not require a DoD 5015.2-certified solution (per Microsoft for non-government entities)
  • Has minimal records management needs
  • Does not have records outside of SharePoint
  • Has a small population of hard-copy records
  • Has resources available to customize SharePoint

The organization may need to investigate additional records management software solutions if it:

  • Operates in a highly regulated industry
  • Is subject to 21 CFR Part 11 rules on electronic records and signatures, the Health Insurance Portability and Accountability Act, the Sarbanes-Oxley Act, or other complex requirements and require detailed audit histories
  • Has multiple record repositories outside SharePoint
  • Has an extensive collection of hard-copy material that needs to be managed and tracked through its lifecycle

Brent Gatewood may be contacted at

From January - February 2009