Security Governance

SharePoint security governance is based around ensuring the confidentiality, integrity, and availability of information and services, while also ensuring that operational activities comply with relevant compliance requirements.

In establishing a workable SharePoint security governance model, it is important to consider who is responsible for what. An example governance model is depicted below.

A Governance model is established through:

• Identifying appropriate roles and responsibilities;
• Structuring the roles and responsibilities to achieve proper accountability and delegation;
• Determining security activities;
• Establishing processes for the continual monitoring and control of activities;
• Ensuring that these activities take place.

Example security roles and responsibilities

Example security procedures

Procedures may be required:

• Assess the business impact of change;
• Request access to sites;
• Request creation of new site / site collection / web application;
• Manage new user requests;
• To assess new SharePoint add-ins.

Example security activities

Secure site configuration in SharePoint includes:

• System administration;
• Content sensitivity assessment;
• Audit logging;
• Document versioning;
• Access controls;