Collaboration Tools Records Management Guide

Collaboration Tools RM Guide

This guide provides an overview of managing digital government information within “collaboration tools” such as MS Teams, OneDrive, or SharePoint. Other Records Management (RM) Guides may provide more detail on specific kinds of tools containing collaboration features, for example the RM Guide on Online Meetings.

Contents 1. Introduction page 1 2. Who is Responsible? page 2 3. Managing Government Information in Collaboration Tools page 3 4. Next Steps page 5 5. Appendix – “How To” Examples page 6

1. Introduction The ways in which we work evolve along with the tools we use to create and manage government information. We need to ensure that our tools continue to support accountability, transparency, and trust in government information. This guide helps you to align your use of collaboration tools to the requirements in the Managing Government Information Policy (MGIP) and the Digital Principles for the Government of British Columbia. Employees assigned with ownership of a collaboration tool can use this guide to develop a recordkeeping action plan. All other employees using collaboration tools can use this guide to support appropriate recordkeeping. Section 3 and the Appendix will help you plan.

1.1 What are Collaboration Tools? Collaboration tools are any tools that help teams and groups work together. Collaboration tools can be used for physical in-person meetings or workshops, including materials such as post-it notes, flipcharts, and whiteboards. They can also be digital tools or software applications. Collaboration tools support business activities such as writing documents, having discussions, or tracking issue tickets. An application can be considered a collaboration tool when it is used simultaneously by multiple employees working together. Working this way can save time and effort otherwise spent passing a document from one person to another or editing separate copies and merging them later. Software features that allow people to collaborate include: ▪ co-editing documents stored in a shared location ▪ presentations and screen sharing ▪ exchanging chat messages and recording videos ▪ conducting polls ▪ updating calendars and tasks ▪ tracking interactions with clients as a team

Government Records Service, Government of British Columbia Revised: 2021-07-15 page 1 Collaboration Tools Records Management Guide

Software applications with collaboration features in use in BC Government include: ▪ Microsoft Office 365 (MS Teams, SharePoint, OneDrive, Skype, Planner, OneNote) ▪ ServiceNow ▪ Salesforce ▪ GitHub ▪ Mural ▪ Trello ▪ Slido

Before using any new collaboration tools, check with your Ministry Information Security Officer (MISO) and Ministry Privacy Officer (MPO).

2. Who is Responsible?

2.1 Responsibilities in General Government bodies are responsible for creating and maintaining records that document their actions and decisions. Doing so ensures that these records will be managed in accordance with government legislation, policy, and standards. These include the Information Management Act, the Managing Government Information Policy, the Recorded Information Management Manual, and the Freedom of Information and Protection of Privacy Act (FOIPPA). Government employees are responsible for ensuring records they create or receive in all formats and systems, including collaboration tools, are filed in an appropriate recordkeeping system so they can be relied upon as evidence.

Documenting Government Decisions To comply with the Information Management Act government bodies must: • ensure an appropriate system is in place for creating and maintaining government information • create and maintain adequate records of their decisions If records in your collaboration tool contain evidence of actions or decisions, they must be managed as records. For more information on what constitutes an appropriate recordkeeping system, and the requirements to document government decisions, see the Chief Records Officer Guidelines on Documenting Government Decisions.

2.2 Responsibilities when Using Collaboration Tools

According to CPPM Chapter 12.3.6, “Information and technology assets must be classified, inventoried and recorded with an identified owner who is responsible for achieving and maintaining appropriate protection of those assets.” Assigning ownership is important because, as projects and teams shift, it will ensure that you and your coworkers will have someone to turn to provide access and to manage the records. Responsibility for records management can be assigned to a team leader, project owner, office manager and/or records

Government Records Service, Government of British Columbia Revised: 2021-07-15 page 2 Collaboration Tools Records Management Guide management resource as part of their regular duties. Each collaboration tool will have its own configuration options, search interfaces, and means of migrating information to an appropriate recordkeeping system. Additional recordkeeping requirements include: ▪ Document how your team has configured and organized the collaboration tool to ensure the information can be maintained and migrated. Consult the relevant information schedule for appropriate classifications to use when filing. ▪ Consult the Government Information in the Cloud RM Guide when acquiring a new collaboration tool, to ensure that it meets government recordkeeping needs. ▪ When a collaboration tool is used by an inter-ministry or inter-jurisdictional committee or working group, identify a lead ministry to be the responsible secretariat for the committee’s records.

3. Managing Government Information in Collaboration Tools While collaboration tools are good for co-editing drafts with a team, they are not considered appropriate recordkeeping systems. As a result, any records of decisions and actions that they contain will need to be routinely moved to systems that are appropriate, such as: ▪ the government standard EDRMS Content Manager ▪ shared drives (i.e. “LAN”) organized and managed according to ARCS and ORCS ▪ line of business applications Most collaboration tools are not appropriate recordkeeping systems due to limited control over records and the potential for alteration or loss of records over time. Consistent and appropriate management can mitigate some risks, but limitations make them unsuitable for the long-term storage of government information and records. Risks of leaving government information within a collaboration tool include: ▪ Restricted access: Limited access to the information may mean employees who need access don’t have it, or access is lost over time as people move on or retire. ▪ Difficulty finding records: Records may not be named, classified or filed appropriately and may be missed when responding to requests under the Freedom of Information and Protection of Privacy Act (FOIPPA) or for a legal search. ▪ Incomplete records: The integrity, authenticity, and trustworthiness of records are not maintained. ▪ Unauthorized destruction: Records may be inadvertently destroyed due to ambiguous or inconsistent records management procedures. ▪ Inappropriate access: Leaving records in the tool beyond their active use may mean sensitive or confidential information is accidentally disclosed as permissions in the tool get updated. The rest of this section provides general principles for managing information in collaboration tools. In addition, the Appendix provides examples of how to apply these principles in specific applications.

Government Records Service, Government of British Columbia Revised: 2021-07-15 page 3 Collaboration Tools Records Management Guide

3.1 Organizing Information in Collaboration Tools Follow information and records management best practices when using collaboration tools, regardless of their communication and documentation features. Use your office’s established naming conventions to name folders and files created in the collaboration tool – see the Naming Conventions RM Guide if you need help with those. Always use a standard format that includes elements like a clear description of the document, the version number, and the date of approval. Where possible, configure collaboration tools to automatically capture metadata. Identify all government information that needs to be moved to an appropriate recordkeeping system, either on a routine basis or at the conclusion of a project. This includes evidence of government business activities, official or final records, substantial drafts, correspondence, and records that document decisions.

3.2 Protecting Government Information within Collaboration Tools Copy, summarize, or transcribe information that provides evidence of a decision or work activity from any collaboration tool to an appropriate recordkeeping system. The most robust system to protect records as evidence is to use the government standard EDRMS Content Manager, which has strong security, auditing, and disposition control functions. Move records on a regular basis or when projects or communications are completed.

Plan and test the migration of records from one system to another: ▪ Know what types of information and records must be migrated to an appropriate recordkeeping system. ▪ Know who is responsible for regularly ensuring records are migrated. ▪ Test what was migrated to an appropriate recordkeeping system to ensure the migration is complete and the information has not been altered unexpectedly. ▪ Confirm that the records remain accessible to appropriate users. ▪ When the migration is determined successful, the source information from the collaboration tool can be deleted. Avoid storing duplicates in multiple systems as this causes confusion to locate and identify the official record.

3.3 Disposition of Transitory Information Government information, including records, must be managed in accordance with Information Schedules, including ARCS, ORCS, and Special Schedules. Information schedules contain the instructions on how to dispose of government information. Once final records (e.g., reports), government decisions, and other non-transitory information have been moved to an appropriate recordkeeping system, any transitory information remaining in the collaboration tool may be destroyed by following the Transitory Information Schedule. Standalone MS Teams chats (outside of a team channel) are most likely to contain transitory information. Therefore the Chief Records Officer (CRO) has issued the memorandum, Retention of Chat Messages in Microsoft Teams, directing that “… standalone one-on-one chats, group chats, and meeting chats be automatically deleted from MS Teams after 30 days, effective May 31, 2021. Conversations within a channel will be retained until manually deleted

Government Records Service, Government of British Columbia Revised: 2021-07-15 page 4 Collaboration Tools Records Management Guide or the channel is decommissioned.” To see the memorandum in context, see the CRO Directives & Guidelines web page.

3.4 Access, Privacy and Security Information created and stored within collaboration tools, like all government information, is subject to FOIPPA. Limit sharing of sensitive or confidential information (e.g. personal information) within any collaboration tool. As with any communication tool, consider that membership within collaboration tools may change over time and could potentially include external service providers. Keep in mind that Privacy Impact Assessments (PIAs) are required for a proposed enactment, system, project, program, or activity and this includes assessing your collaboration tools. Prepare to respond to information access requests under FOIPPA or other legal obligations. For more FOIPPA advice, see Access to Information, Privacy & Personal Information, and the FOIPPA Policy and Procedures Manual. For additional privacy and security measures when accessing government information stored within collaboration tools consult the Appropriate Use Policy. Your ministry may have established restrictions regarding use of collaboration tools. For more information about IM/IT Security, see the Information Security website or check with your Ministry Privacy Officer (MPO) or your Ministry Information Security Officer (MISO). Only government information with an information security classification of “public” should be stored in cloud-based tools unless additional security controls have been applied (e.g. Multi-Factor Authentication).

4. Next Steps Discuss this RM Guide at your next team or project meeting. Your team can use this guide to plan and implement good information management practices when using collaboration tools. Consider adding this as a goal in your performance plan.

For further assistance, contact your Records Team or check out the Records Management website.

Government Records Service, Government of British Columbia Revised: 2021-07-15 page 5 Collaboration Tools Records Management Guide

5. Appendix – “How To” Examples As collaboration tools change frequently, technical support can be obtained through the following: ▪ OCIO My Service Centre for technical assistance and knowledge articles. ▪ “IT Support” on @Work for a list of technical support options. ▪ In MS Teams, click “Info Centre” and select an application to learn more. The following tips are based on the records management best practices. Note: If you have a collaboration tool or scenario that would be useful to include in this Appendix, please contact [email protected].

5.1 Tips for Organizing

5.1.1 Plan which app will help you work efficiently To help choose an application with collaboration features, consider the following:

Features Applications How Features Enable Collaboration Co-edit documents SharePoint (via ▪ share files MS Teams) ▪ get real-time alerts as others use shared files OneDrive ▪ leave messages about changes made to files GitHub ▪ start impromptu chats and meetings with colleagues Co-edit wiki OneNote ▪ multiple authors can collaboratively draft and documents Confluence edit text together MS Teams Conduct meetings MS Teams ▪ quickly share screens Presentations Skype ▪ draw on a whiteboard Screen shares Slido ▪ stimulate discussion with polls Polls ▪ record short impromptu videos together Record videos Chat MS Teams ▪ quickly invite or “@” another colleague to a Skype discussion RocketChat ▪ ask questions or conduct polls Share tasks Trello ▪ plan and track project tasks Tasks/Planner ▪ start impromptu chat messages in context ▪ send “@” notifications ▪ co-author items Track interactions ServiceNow ▪ co-edit summaries of issues and cases as a team SalesForce ▪ leave quick chat messages with updates on a Co-edit documents Dynamics particular case/file ▪ contact colleagues and clients with “@” notifications ▪ create wiki-like knowledge base articles

Government Records Service, Government of British Columbia Revised: 2021-07-15 page 6 Collaboration Tools Records Management Guide

5.1.2 Plan the Structure of Microsoft (MS) Teams When your group sets up a new team in MS Teams, take the time to plan out the structure before the group begins to use it to store government information. As an example, if your branch is responsible for research and advisory services, you could start by creating a “Channel” titled “Research Administration.” This aligns with their Operational Records Classification System (ORCS) 29900-15. Within this Channel, a “Conversation” could be started titled “Research Requests” where everyone in the team can add “Replies” in one place. Another Conversation in the Channel could be titled “Updates to File Lists” so that team research staff could add a Reply whenever they update a file list. The team should also agree on using a naming convention for multiple “Research - [Topic]” Channels so they all align with secondary classification 29900-10 in their ORCS. Organizing your MS Team before making use of it will make it much easier to routinely move information to an appropriate recordkeeping system and to defensibly dispose of government information when no longer needed.

5.1.3 Plan Folder Structures in Microsoft SharePoint Take the time to plan the folders in your team’s SharePoint site carefully. Plan a folder structure based on work activities and business processes. For example, you could make a folder called “ARCS 220-20 Conferences and Events”. By grouping all your team’s event files together in one shared folder it’s easier to manage them as a set. Once you have gathered these lists into one shared location, then it will be easier to identify duplicates. Organizing your folders according to the business activities found in an information schedule will help you migrate them to an appropriate recordkeeping system such as EDRMS.

Another way to manage records in SharePoint is to create a technical policy (i.e., a set of configurable rules that can be used to delete files or an entire site when no longer needed). The policy rules can run automatically or require an employee review. You can also send automatic notification emails to users and administrators before deletion occurs. Use technical policies with caution because, once they are in use, they can be difficult to reconfigure.

5.1.4 Plan Folder Structures in OneDrive Plan the folders in your personal OneDrive carefully. It is best to create a simple folder structure before you start saving files in this location. The longer you leave your records unmanaged, the harder it will be to organize them later. Plan a folder structure based on the work activities you do or your business processes. A quick and easy way to identify business activities is by looking at your ARCS and ORCS information schedules. For example, create a folder for records related to Staff Meetings for your work unit. Include details such as classification number and if your copy is the official file copy. Grouping related records together in a folder makes it more efficient to locate and manage them. When you organize files in your OneDrive according to business activities, it can help you migrate them to an appropriate recordkeeping system later.

Government Records Service, Government of British Columbia Revised: 2021-07-15 page 7 Collaboration Tools Records Management Guide

5.2 Tips for Migration For a simple transfer of selected records from MS Teams to an appropriate recordkeeping system: 1. download the records to a temporary location on your workstation 2. upload the records from the temporary location to your office’s appropriate recordkeeping system Migrate your records to an appropriate recordkeeping system on a continuous basis. For example, “Project records migration” could be a recurring agenda item in a regular project meeting. Records should also be migrated when the project is complete and the SharePoint site (as seen in the Teams interface) is no longer being used.

5.2.1 Migrate Files from SharePoint / OneDrive Here are some useful tips on migrating your records off SharePoint or OneDrive, which provides the document storage functionality in MS Teams: ▪ Determine what needs to be migrated. Records that are critical to documenting the activities or decisions made by the group should be migrated regardless of whether they originated from within or outside of your office/branch (e.g. another ministry, government, vendor, or group). ▪ Create a file list. SharePoint can save file lists to an Excel spreadsheet. These lists can have useful metadata about the documents including name, title, when it was created, when it was last modified and by whom, its location on the SharePoint site, as well as any custom metadata fields that may have been created. These lists provide context for future appraisal and destruction decisions. Before you delete anything from the site, create file lists of all records that reside on it. Store this list alongside the records in your new storage location or appropriate recordkeeping system. ▪ Migrate records from SharePoint to another storage location or appropriate recordkeeping system. ▪ Conduct quality assurance. Verify that the folder structure accurately represents the folder structure of the document library in the SharePoint site. Check a sample of the files that were migrated to ensure they have been copied successfully.

5.2.2 Document Meeting Decisions Document meetings conducted using collaboration tools (e.g., MS Teams, Skype, Slido) the same way you would any other meeting. This may be a simple text file or include an audio or audiovisual recording. The decision to record a call or meeting is at the discretion of the organizer. If recording a call or meeting, the organizer must ensure FOIPPA requirements are met prior to doing so. For example, if the recording captures personal information, then a collection notice may be required, and the organizer must ensure the recording is managed in a way that protects privacy in accordance with FOIPPA. For further guidance, see the Information, Privacy and Security sections of the Teams application within the MS Teams’ Info Centre, or the Office 365 Portal, which includes information for “Recording Teams Meetings, Chats or Calls.”

Government Records Service, Government of British Columbia Revised: 2021-07-15 page 8 Collaboration Tools Records Management Guide

5.2.3 Document Skype Instant Messages Decisions Document any Instant Messages (IMs) that provide evidence of a decision or work activity and file it in your recordkeeping system, such as EDRMS Content Manager. Note that even if you do not save the conversation, your correspondent may choose to do so. Skype IMs can be set to be retained indefinitely in the Conversation History folder in Outlook, otherwise they will be deleted as soon as you close the window.

5.3 Tips for Disposition

5.3.1 Retention of Chat Messages Routinely identify transitory information that can be destroyed according to the Transitory Information Schedule. Within MS Teams there are two broad categories of chat messages: ▪ standalone one-on-one or group chats, meeting chats, and ▪ conversations within a channel. Under the Information Management Act, the Chief Records Officer is responsible for policy relating to the retention of government information. The CRO Memorandum Retention of Chat Messages in Microsoft Teams directs that standalone one-on-one chats, group chats and meeting chats be automatically deleted from MS Teams after 30 days. Conversations within a channel will be retained until manually deleted or the channel is decommissioned. Chat messages may be relevant to a FOIPPA search or legal hold, whether they are transitory or not. As MS Teams is not an appropriate recordkeeping system, you must: ▪ document any Teams chat information that provides evidence of a decision or work activity, ▪ copy, summarize, or transcribe the information to another document, and ▪ file it in your recordkeeping system.

5.3.2 Disposition of Files in SharePoint / OneDrive Post-Migration When records have been successfully migrated to an appropriate recordkeeping system and are no longer needed on the SharePoint site or OneDrive, the documents become redundant and can be deleted under the Redundant Source Information Special Schedule.

Government Records Service, Government of British Columbia Revised: 2021-07-15 page 9