2.25.20. SharePoint

(1) SharePoint Services was established to consolidate infrastructure operations and provide enterprise-wide governance and oversight into SharePoint activities.

(1) All IRS SharePoint environments are managed exclusively by SharePoint Services. No SharePoint servers or SharePoint Server software will be deployed/installed without prior approval from SharePoint Services.

(2) SharePoint Site Collections will only be created or deleted after approval from SharePoint Services.

(3) Once created, Site Collections are the responsibility of the requesting Business Unit unless ownership is transferred to another Business Unit.

(4) Any request to change, alter, or add to the IRS SharePoint system infrastructure must be reviewed and approved by SharePoint Services.

(1) The Chief Information Officer (CIO) ultimately is responsible for this program as part of IT-EOps.

(2) SharePoint Services is responsible for implementation, operations, maintenance, management, governance, and enhancement of the SharePoint operating environment including all related hardware, software, and server configuration.

• SharePoint Services is responsible to support best-practices and operational consistency via the performance of various communication and education activities.

(3) Individual IRS Business Units are responsible for ensuring that SharePoint is used in compliance with IRS policy and provide the primary support for their users.

• The individual IRS Business Units are responsible to ensure their use of the SharePoint platform complies with all applicable privacy and data protection laws, regulations, and policies.

• The individual IRS Business Units are responsible to ensure their use of the SharePoint platform complies with applicable sections of the IRS Internal Revenue Manual (IRM) including, but not limited to, the following:

• IRM 10.8.1, Information Technology Security, Policy and Guidance

• IRM 10.8.2, Information Technology Security, IT Security Roles and Responsibilities

• IRM 11.3.12, Disclosure of Official Information, Designation of Documents

(1) The Infrastructure Enterprise Steering Committee (IESC) is the source of funding for SharePoint and provides high-level governance for the SharePoint program.

(2) The Enterprise Technology Implementation Division (ETID) is responsible for oversight of SharePoint activities and reports to the IESC.

(3) The SharePoint Governance Board (SPGB) and the Federal (FED) Customer Advisory Board (CAB) provide additional oversight and direction to SharePoint Services.

(4) Most program-level direction, strategy, and change management decision making authority has been delegated to SharePoint Services.

(1) This program uses multiple sources to establish controls. This IRM constitutes one of the controls.

(2) The SharePoint Program Project Management Plan (PMP) (available on SharePoint Central) is a resource guide used to manage the various SharePoint specific duties of governance process, operational controls and other activities at an enterprise level.

(3) The SharePoint Site Management Guide (available on SharePoint Central) specifies required activities, guidance, and policy for the management of individual site collections and sub-sites.

(4) The Self-Services Request Processes - Standard Operating Procedures (SOPs) specify program-level controls relative to the performance of the following SharePoint processes:

• Site Collection Deployment

• Site Collection Deletion

• Site Collection Quota Management

• Infrastructure Change Requests

• Deployment Requests

(1) This program has specific terms and acronyms associated with it.

(2) The table lists commonly used terms and their definitions:

(3) The table lists commonly used acronyms and their definitions:

(1) The SharePoint Program/Project Management Plan (PMP) is a resource for information about this program and is available on SharePoint Central.

(2) SharePoint Central is a site providing a primary method to communicate announcements, procedures, policies, and support articles.

(1) SharePoint Governance is a function of SharePoint Services. This is performed via interfaces with various governance organizations including the Infrastructure Executive Steering Committee (IESC).

(2) SharePoint Governance organizations and roles are identified in IRM 2.25.20.3.4.4, SharePoint Governance Roles.

(3) The primary objective of SP governance is to ensure the SharePoint platform is implemented and managed in a manner that follows IRS policy, procedures, and regulations.

(4) SharePoint governance includes the various Business Units to ensure that all stakeholders’ interests are considered.

(5) The specific duties of governance process are documented in the SharePoint Program/Project Management Plan (PMP).

(6) Local Business Unit SharePoint governance should not conflict with IRS SharePoint Services Governance policy, procedures, and regulations. IRS and SharePoint Services governance policy has precedence over local policy. Local policy is the ruling policy for the business unit unless it conflicts with IRS and SharePoint Services policy.

(1) The mission of this office is to deliver superior, leading-edge, flexible, and cost-effective collaborative solutions that enable IRS staff to solve business problems and complete activities.

(2) The primary purpose of this office is to perform day-to-day management of the IRS SharePoint platform, including ensuring operational continuity, enforcing policies, providing enterprise-wide governance, performance of all maintenance, and oversight of environment change management. The objectives of this office are to:

• Maintain SharePoint successful operational up-time and minimize down-time mitigating risks associated with unavailability of the platform.

• Interface with IRS Information Technology stakeholders, as needed, to perform maintenance, patching, and infrastructure changes.

• Provide change management oversight for changes to SharePoint infrastructure/configuration or the deployment of customizations (including custom server-side code) to the platform.

(3) The secondary purpose of this office is to define, develop, institutionalize, and maintain proven guidance for the use of SharePoint (and related systems). The objectives of this office are to:

• Identify strategic direction for SharePoint with consideration of IRS requirements, external process owners, and operational constraints of the platform.

• Integrate and standardize process and change management activities to promote repeatable processes and consistency.

• Provide leadership, consultation, and assistance to ensure understanding and effective use policy and guidance by all affected stakeholders.

(4) SharePoint Services does not generally perform site collection administration or other support activities that typically fall to the Site Managers. Exceptions may be made at SharePoint Services’ discretion.

(5) SharePoint Services provides high-level support to the Business Units via a hierarchical model that involves:

• Users elevating concerns or needs to the appropriate Site Owner or Site Collection Administrator.

• Site Owners or Site Collection Administrators escalate questions or concerns to the appropriate Business Unit Representatives.

• Business Unit Representatives contact SharePoint Services for resolution of questions as needed.

(1) SharePoint Services manages the SharePoint platform and works with the Business Unit Representatives (BU Reps) or other Points-of-Contacts (POCs) to support SharePoint operations.

(2) The SharePoint Services supports the activities of the various IRS organizational units formalized by SharePoint Self-Services Requests, KISAM/OS GetServices Tickets, Patch Management, Backup/Restore Requests, Operations & Maintenance Services and other ad-hoc SharePoint Service Requests.

(3) The SharePoint Services manages the platform’s infrastructure including all hardware, software and components comprising the SharePoint environment.

(4) The SharePoint Services establishes enterprise IRS SharePoint governance policy and best practices.

(1) Business Units are responsible for ensuring their organization’s SharePoint sites are used in compliance with IRS policy.

(2) Business Units own and manage the content (e.g. document libraries, lists, calendars, etc.) associated with their SharePoint Site Collections.

(3) Business Units are responsible for ensuring their organization’s use of SharePoint is compliant with applicable data management and processing rules, policies, and other applicable IRMs.

(4) Business Units can develop their own supplemental or organization specific policies regarding SharePoint use and management.

• Participants in the development of any enhanced, supplemental, or organization specific SharePoint policy are determined by the IRS organization developing policy.

• SharePoint Services recommends that individuals shaping organization specific SharePoint policy be involved and engaged with the SharePoint Services via the various SP governance organizations (for example, the SharePoint Governance Board (SPGB) or the Federal (FED) Customer Advisory Board (CAB)) that provide oversight and direction to SharePoint Services.

• Any organization specific or enhanced SharePoint policy is scoped and limited to what is supportable by the SharePoint Services from operational, organizational, and governance and policy perspectives. SharePoint Services does not alter its practices or procedures to satisfy Business Unit specific policies or requirements.

(5) This IRM and all SharePoint Services identified policies and procedures takes precedence over any Business Unit specific policy.

(1) Site Collections are a unit within SharePoint that comprise one or more sites in a hierarchy and provides a logical and secure boundary to compartmentalize functionality and content.

(2) Site Collections are a fundamental SharePoint element; they hold all the sites that share a similar theme or purpose.

(1) IRS SharePoint includes other roles that are ancillary or defined to support IRS specific activities.

(1) SharePoint Services is responsible for establishing policies, providing direction, and communicating guidance for security of the SharePoint platform. This includes, but is not limited to, the following:

• Providing guidance for site collection creation, access and group controls

• Establishing security policy for the following:

• Purpose (or reason for some policy, guidance, or recommendation)

• Scope

• Roles/Responsibilities

• Executive Sponsorship

• Compliance

• Identifying information site account types to support organizational missions/business functions

• Providing guidance to site managers for group and role membership

• Requiring approval by the Business Unit (Delegated Business Sponsors or Business Unit Representatives) for requests to create sites for which they are responsible

• Establishing a process for reissuing shared/group account credentials when individuals are removed from the group

(2) The SharePoint Program/Project Management Plan (PMP) is a resource for information about this program and is available on SharePoint Central.

(1) The individual Business Units are responsible for applying and enforcing security policies, guidance, and recommendations across all owned site collections. This includes, but is not limited to, the following:

• Ensure implementation of security controls for protecting sensitive (i.e., SBU, PII) IRS data residing in the BU’s SharePoint sites and collaborative environments.

• Ensure all applicable security training requirements are met by employees managing SharePoint.

• Following any SharePoint relevant Access Controls (AC) and enhancements including:

• IRM 10.8.1.4.1.1 Section (1 sub-sections b, d, e, f), (2), (3), (4), (5), (6), (7, (8), and (9)

• IRM 10.8.1.4.1.1.1 Sections (1) and (6)

• IRM 10.8.1.4.1.1.7 All sections

• IRM 10.8.1.4.1.1.11 All sections

• IRM 10.8.1.4.1.2 All sections

• Following any SharePoint relevant Audit Controls (AU) and enhancements including:

• IRM 10.8.1.4.3.1 All sections

• IRM 10.8.1.4.3.1.1 All sections

• IRM 10.8.1.4.3.2 All sections

• Assign Site Managers to manage and perform the various security activities.

(1) Site Managers (Site Collection Sponsors, Site Collection Administrators, and Site Owners) are responsible for performing recommended security practices and activities for all assigned SharePoint sites (Site Collections or sub-site). This includes, but is not limited to, implementing security controls and enhancements.

(2) Site Managers shall be assigned by the Business Units.

(1) Proper operation of the SharePoint environment requires specific governance, numerous policies and processes, and artifacts to guide the actions of SharePoint program staff, Business Units, and end users.

(1) SharePoint Services interfaces with process owners to ensure IRS policies are complied with in the IRS SharePoint environment. The process owners include:

• Privacy, Governmental Liaison and Disclosure (PGLD) – Determines the PII/SBU data policies all SharePoint site owners and users must follow and identifies the records management configuration and policies that must be supported by SharePoint to support in-place and centralized records management.

• Information Resources Accessibility Program (IRAP) – Determines the accessibility requirements which apply to the IRS SharePoint platform.

• CyberSecurity – Establishes baseline security controls and configurations for servers and guidance for all servers and network components comprising the IRS SharePoint platform.

• Enterprise Services/Enterprise Architecture – Develop the technical architecture and direction, including product selection, in coordination with SharePoint Services.

(1) The storage of PII/SBU in SharePoint is authorized provided approval from PGLD has been obtained (prior to storing PII/SBU data) in the form of a current SP PIA.

• SharePoint users are required to ensure that sensitive information is protected from unauthorized disclosure and access. This includes taxpayer information as well as other non-tax information, documents, records and processes.

(2) SharePoint Services supports the creation and submission of SharePoint specific Privacy Impact Assessments (SP PIA) to Privacy, Governmental Liaison and Disclosure (PGLD) per IRM 10.5.2.2, Privacy and Civil Liberties Impact Assessment (PCLIA).

(3) SharePoint Services is not responsible for the monitoring of SP PIA status and will rely on PGLD to notify SharePoint Services if a site is not in compliance.

(4) The PII/SBU compliance status of a site collection must be reviewed and certified periodically by the Site Collection Administrators, per the IRS Site Management Guide in accordance with PGLD requirements.

(5) Failure of the Business Unit and Site Collection Administrators to certify by the deadline could lead to the site being disabled or removed at the discretion of SharePoint Services and/or PGLD.

(6) The storage of PII/SBU data is not permitted within SharePoint Development or Test environments.

(1) Permissions should be assigned via SharePoint Groups. Direct permissions should be used when the use of groups is not feasible or practical (typically in situations when item level permissions are used as part of an automated tool). Permissions best-practices are discussed within the IRS Site Management Guide.

(2) Site Collection permissions must be reviewed and certified periodically by the Site Collection Administrators, per the IRS Site Management Guide according to guidelines determined by SharePoint Services, approved policies, or any applicable IRMs.

(3) Failure to certify by the deadline could lead to the Site Collection being disabled or removed at the discretion of SharePoint Services and/or CyberSecurity.

(4) Site Collection Administrators and Owners are discouraged from making any changes to the base SP Permissions model including customizations to the Out-of-the-Box (OOB) permission levels.

(5) All infrastructure changes made to IRS SharePoint to support permissions management are reviewed and approved by SharePoint Services.

(1) Unless otherwise authorized by the SharePoint Services, all Site Collections must have auditing of permission changes enabled with at least a 120-day audit log retention. Site Collection Administrators are free to enable additional auditing and specify a longer retention time.

(2) Audit Logs must be reviewed and certified periodically by the Site Collection Administrators, per the IRS Site Management Guide according to guidelines determined by SharePoint Services, approved policies, or any applicable IRMs.

(3) Failure to certify by the deadline could lead to the site being disabled or removed at the discretion of SharePoint Services and/or CyberSecurity.

(4) The individual IRS Business Units are responsible to ensure their SharePoint permissions and permissions auditing complies with applicable sections of the IRS IRM including; but not limited to, the following:

• IRM 10.8.1, Information Technology Security, Policy and Guidance

• IRM 10.8.2, Information Technology Security, IT Security Roles and Responsibilities

(1) Records stored in SharePoint must be managed in accordance with PGLD guidelines as documented in IRM 2.25.20.2.2.1.4, SharePoint Records Management and IRM 1.15, Records and Information Management.

(1) SharePoint Services will maintain Development, Test, Disaster Recovery, Production, and SP Custom, etc. environments as required based on the established technical architecture.

(2) SharePoint Services establishes thresholds, limits, or other throttles to functions within the IRS SharePoint environment to reduce operational risks to uptime targets.

(3) Any request to remove, change, or modify the environmental thresholds, limits, or throttles must be reviewed and approved by SharePoint Services via the SharePoint Change Management process (see Self-Services Standard Operating Procedures (SOP) for additional details).

(1) SharePoint Services predefines Site Collection types to ensure that deployed sites are consistent with applicable design standards, accessibility regulations, and SharePoint recommendations.

(2) The various types of Site Collections are defined within the IRS Site Management Guide.

(1) SharePoint servers and all related server configurations are managed by SharePoint Services.

(2) Requests to change configurations of components must be reviewed and approved by SharePoint Services via the SharePoint Change Management process (see Self-Services Standard Operating Procedures (SOP) for additional details).

(1) All SharePoint infrastructure, including physical or virtual components, or any interfacing software is managed by SharePoint Services.

(1) Infrastructure and configuration of SharePoint Technical environment is audited in compliance with applicable sections of the IRS IRM including; but not limited to, the following:

• IRM 10.8.1, Information Technology Security, Policy, Guidance

• IRM 10.8.6.3.3, Audit and Accountability

(1) The IRS SharePoint Backup Plan provides additional details on the IRS SharePoint Disaster Recovery function.

(2) Any external connections made to IRS SharePoint may require manual configuration disaster recovery operation.

(3) External connections must be configured within the DR environment for disaster recovery operations to perform automatically.

(4) External connections must be reviewed and approved by SharePoint Services prior to implementation.

(1) All maintenance to the IRS SharePoint environment (including patching and upgrades) is performed by SharePoint Services in accordance with the documented Change Management practices (see Self-Services Standard Operating Procedures (SOP) for additional details).

(1) Changes to the SharePoint infrastructure, the deployment of server-side managed code, and the moving of sites between environments are performed via the SharePoint Change Management process documented on SP Central.

(2) SharePoint Services has established a set of practices and procedures that must be followed in performing customization activities.

• Proposed server-deployed code should be vetted by SharePoint Services prior to analysis and development.

• To submit a proposed concept for consideration SP users will create an entry on the SharePoint Registry.

(3) Server-deployed custom code shall be developed consistent with the IRS SharePoint Development Standard available on SharePoint Central.

(4) All server-deployed custom code developed by business units with the intention of deployment to the IRS SharePoint environment shall be developed in accordance to IRS Enterprise Life-Cycle (ELC) methodology (and documentation requirements).

(5) SharePoint Services must approve all proposals for server-deployed custom code prior to development (via the SharePoint Change Control Board (SP CCB)).