Email remains one of the most common and unmanaged record types. Without clear rules, important decisions are lost or retained indefinitely. Clear guidance reduces risk and improves efficiency. 1. Do your employees know which emails are records? 2. Is there guidance on email retention? Action: Draft a short guideline defining when an email becomes a record.

When a manager or executive leaves the company, their digital workspaces are often abandoned, creating terabytes of unmanaged, high-risk "orphaned" data. Implementing an orphaned data remediation workflow ensures these files are actively reviewed, reassigned, or defensibly destroyed. 1. How many terabytes of unowned "orphaned" data are currently sitting on your active servers? 2. What is your procedure for reassigning ownership of a departed manager's digital workspace? Action Item: Ask your IT department to run a report identifying network folders with no active owner.

Left unchecked, Microsoft 365 and SharePoint environments rapidly turn into unmanageable data swamps of abandoned sites and duplicated files. Implementing a strict provisioning process ensures that new sites are only created with baked-in retention rules and an assigned owner. Can any employee in your organization click "Create New Team" without administrative approval? Action Item: Implement a mandatory approval workflow for the creation of any new SharePoint site or Microsoft Team.

Software formats become obsolete rapidly, meaning a proprietary file saved today might be unreadable in 15 years. Mandating open archival formats like PDF/A for your permanent records ensures long-term preservation and accessibility independent of the original software. 1. Are you currently archiving finalized reports in editable Word formats that might lose their formatting in future updates? Action Item: Update your procedures to require PDF/A format for all records designated for permanent or long-term retention.

Data Loss Prevention (DLP) tools can automatically block highly classified records from being emailed outside the company. Working with IT to apply DLP metadata tags to your sensitive records creates a technical barrier against accidental data leaks. 1. What prevents an employee from accidentally attaching your most confidential board minutes to an external email? Action Item: Work with your InfoSec team to configure a DLP rule that blocks the external sharing of documents tagged "Confidential."