There are many different reasons to create policies in SharePoint. One of the main reasons my clients are looking to implement policies is for auditing purposes. They want to know what their users are doing and they want to be able to track that information over a period of time. This is a perfect reason to create a policy. By definition an information management policy is a rule or set of rules pertaining to information. For example, I might want to enforce a policy that determines the timeline of when documents can be deleted with a specific document library (known as an expiration policy).

An information management policy is a set of rules for a type of content. Information management policies enable organizations to control and track things like how long content is retained or what actions users can take with that content. Information management policies can help organizations comply with legal or governmental regulations, or they can simply enforce internal business processes. For example, an organization that must follow government regulations requiring that they demonstrate “adequate controls” of their financial statements might create one or more information management policies that audit specific actions in the authoring and approval process for all documents related to financial filings.

There are four policies that SharePoint provides: Expiration, Auditing, Labels, and Barcodes. Policies can be created at the granular level of the library or at a more global level at the site collection. Policies created at the site collection level can be created once and then reused throughout the site collection. Each individual rule within an information management policy is a policy feature. Office SharePoint Server 2007 includes several predefined policy features that organizations can use individually or in combination to define information management policies for their sites. The policy features included in Office SharePoint Server 2007 are:

• Auditing  The Auditing policy feature helps organizations analyze how their content management systems are used by logging events and operations that are performed on documents and list items. Organizations can configure the Auditing policy feature to log events such as when a document or item is edited, viewed, checked in, checked out, deleted, or has its permissions changed. All of the audit information is stored in a single audit log on the server, and site administrators can run reports on it. Organizations can also use the Office SharePoint Server 2007 Object Model to write and add custom events to the audit log.

• Expiration  The Expiration policy feature helps organizations delete or remove out-of-date content from their sites in a consistent, trackable way. This policy feature helps organizations manage both the cost and risk associated with retaining out-of-date content. Organizations can configure an Expiration policy to specify that certain types of content expire on a particular date or within a calculated amount of time after some document activity (such as creating or editing).

• Barcodes  The Barcodes policy feature enables organizations to track physical copies of documents or list items that have been printed from a site. The Barcode policy feature creates a unique identifier value for a document. Users can then insert a barcode image of that value into the Microsoft Office documents they create. They can also use a barcode on a physical copy of a document to search for the original copy of that document on the server. By default, barcodes are compliant with the common Code 39 standard (ANSI/AIM BC1-1995, Code 39). Organizations can use the Office SharePoint Server 2007 Object Model to install other barcode providers.

• Labels  The Labels policy feature also enables organizations to track physical copies of documents or list items that have been printed from a site. The Labels policy feature automatically generates text labels based on document properties and formatting that a site administrator or list manager specifies. When users insert labels into Microsoft Office documents, the labels are updated automatically with the information from the document’s properties. 

For additional information regarding policies and policy definitions check out this Microsoft Article. Microsoft also provides a set of generic steps on how to Create an Information Management Policy for a Site Collection.

In this example we will create a site collection auditing policy and apply it to a library in a sub site. Keep in mind that although we enabled auditing within this library, to view the reports there are some settings on the server that need to be configured. Please see the previous blog Enabling Site Statistics in a MOSS Site.

To create a site collection policy follow these steps: 

1. Navigate to the top level site within your site collection by clicking on Site Actions –> Site Settings (if you are using a MOSS template you will then need to click Modify All Site Settings).
2. In the Site Collection Administration section click Site Collection Policies.
3. On the Site Collection Policies page click Create.
   
   
    
4. Fill in the Name field with a descriptive name for the policy. In this example I will use Company Auditing Policy.
5. Fill in the Administrative Description field. This information is displayed to list managers when configuring policies on a list or content type.
6. Fill in the Description field. This information is displayed to the users when they are implementing the policy on a list or content type.
   
   
    
7. Next you will need to decide the type of policy you are creating. In this example I will select Auditing and select all items except the first one (Opening or downloading documents…). Click OK to create the policy.

The next step is to apply the policy to a list or library.

1. Navigate to the library where you want to apply this policy. In my example I am in the Shared Documents library.
2. Go to the Settings menu and select Document Library Settings.
   
   
    
3. In the Customize Shared Documents page, in the Permissions and Management section, click the Information management policy settings link.
   
   
    
4. Select Use a site collection policy and pick the policy from the drop down menu.
   
   
    
5. Click OK to apply the policy. At this point the policy is applied to the library and will start logging the users actions.

To view the auditing reports see this blog.

Sharee English (MCSD, MCAD, MCT) is the Director of Information Services at SeattlePro Enterprises, an IT training and consulting company. She started her career as a programmer, delving into Web technologies almost twenty years ago. Today she is a highly educated executive with background in software development, training, authoring, management, operations, administration and sales. Sharee holds a Master of Arts in Management (emphasis in Information Systems), a Bachelor of Science (B.S.) in Computer Science and a B.S. in Mathematics.

If you would like to provide feedback on this article, please click here.

Copyright ©2010 SeattlePro Enterprises. All rights reserved.