SharePoint Services was established to consolidate infrastructure operations and provide enterprise-wide governance and oversight into SharePoint activities.

All IRS SharePoint environments are managed exclusively by SharePoint Services. No SharePoint servers or SharePoint Server software will be deployed/installed without prior approval from SharePoint Services.

SharePoint Site Collections will only be created or deleted after approval from SharePoint Services.

Once created, Site Collections are the responsibility of the requesting Business Unit unless ownership is transferred to another Business Unit.

Any request to change, alter, or add to the IRS SharePoint system infrastructure must be reviewed and approved by SharePoint Services.

The Chief Information Officer (CIO) ultimately is responsible for this program as part of IT-EOps.

SharePoint Services is responsible for implementation, operations, maintenance, management, governance, and enhancement of the SharePoint operating environment including all related hardware, software, and server configuration.

Individual IRS Business Units are responsible for ensuring that SharePoint is used in compliance with IRS policy and provide the primary support for their users.

The Infrastructure Enterprise Steering Committee (IESC) is the source of funding for SharePoint and provides high-level governance for the SharePoint program.

The Enterprise Technology Implementation Division (ETID) is responsible for oversight of SharePoint activities and reports to the IESC.

The SharePoint Governance Board (SPGB) and the Federal (FED) Customer Advisory Board (CAB) provide additional oversight and direction to SharePoint Services.

Most program-level direction, strategy, and change management decision making authority has been delegated to SharePoint Services.

This program uses multiple sources to establish controls. This IRM constitutes one of the controls.

The SharePoint Program Project Management Plan (PMP) (available on SharePoint Central) is a resource guide used to manage the various SharePoint specific duties of governance process, operational controls and other activities at an enterprise level.

The SharePoint Site Management Guide (available on SharePoint Central) specifies required activities, guidance, and policy for the management of individual site collections and sub-sites.

The Self-Services Request Processes - Standard Operating Procedures (SOPs) specify program-level controls relative to the performance of the following SharePoint processes:

This program has specific terms and acronyms associated with it.

The table lists commonly used terms and their definitions:

The table lists commonly used acronyms and their definitions:

The SharePoint Program/Project Management Plan (PMP) is a resource for information about this program and is available on SharePoint Central.

SharePoint Central is a site providing a primary method to communicate announcements, procedures, policies, and support articles.

SharePoint Governance is a function of SharePoint Services. This is performed via interfaces with various governance organizations including the Infrastructure Executive Steering Committee (IESC).

SharePoint Governance organizations and roles are identified in IRM 2.25.20.3.4.4, SharePoint Governance Roles.

The primary objective of SP governance is to ensure the SharePoint platform is implemented and managed in a manner that follows IRS policy, procedures, and regulations.

SharePoint governance includes the various Business Units to ensure that all stakeholders’ interests are considered.

The specific duties of governance process are documented in the SharePoint Program/Project Management Plan (PMP).

Local Business Unit SharePoint governance should not conflict with IRS SharePoint Services Governance policy, procedures, and regulations. IRS and SharePoint Services governance policy has precedence over local policy. Local policy is the ruling policy for the business unit unless it conflicts with IRS and SharePoint Services policy.

The mission of this office is to deliver superior, leading-edge, flexible, and cost-effective collaborative solutions that enable IRS staff to solve business problems and complete activities.

The primary purpose of this office is to perform day-to-day management of the IRS SharePoint platform, including ensuring operational continuity, enforcing policies, providing enterprise-wide governance, performance of all maintenance, and oversight of environment change management. The objectives of this office are to:

The secondary purpose of this office is to define, develop, institutionalize, and maintain proven guidance for the use of SharePoint (and related systems). The objectives of this office are to:

SharePoint Services does not generally perform site collection administration or other support activities that typically fall to the Site Managers. Exceptions may be made at SharePoint Services’ discretion.

SharePoint Services provides high-level support to the Business Units via a hierarchical model that involves:

SharePoint Services manages the SharePoint platform and works with the Business Unit Representatives (BU Reps) or other Points-of-Contacts (POCs) to support SharePoint operations.

The SharePoint Services supports the activities of the various IRS organizational units formalized by SharePoint Self-Services Requests, KISAM/OS GetServices Tickets, Patch Management, Backup/Restore Requests, Operations & Maintenance Services and other ad-hoc SharePoint Service Requests.

The SharePoint Services manages the platform’s infrastructure including all hardware, software and components comprising the SharePoint environment.

The SharePoint Services establishes enterprise IRS SharePoint governance policy and best practices.

Business Units are responsible for ensuring their organization’s SharePoint sites are used in compliance with IRS policy.

Business Units own and manage the content (e.g. document libraries, lists, calendars, etc.) associated with their SharePoint Site Collections.

Business Units are responsible for ensuring their organization’s use of SharePoint is compliant with applicable data management and processing rules, policies, and other applicable IRMs.

Business Units can develop their own supplemental or organization specific policies regarding SharePoint use and management.

This IRM and all SharePoint Services identified policies and procedures takes precedence over any Business Unit specific policy.

Site Collections are a unit within SharePoint that comprise one or more sites in a hierarchy and provides a logical and secure boundary to compartmentalize functionality and content.

Site Collections are a fundamental SharePoint element; they hold all the sites that share a similar theme or purpose.

IRS SharePoint includes other roles that are ancillary or defined to support IRS specific activities.

SharePoint Services is responsible for establishing policies, providing direction, and communicating guidance for security of the SharePoint platform. This includes, but is not limited to, the following:

The SharePoint Program/Project Management Plan (PMP) is a resource for information about this program and is available on SharePoint Central.

The individual Business Units are responsible for applying and enforcing security policies, guidance, and recommendations across all owned site collections. This includes, but is not limited to, the following:

Site Managers (Site Collection Sponsors, Site Collection Administrators, and Site Owners) are responsible for performing recommended security practices and activities for all assigned SharePoint sites (Site Collections or sub-site). This includes, but is not limited to, implementing security controls and enhancements.

Site Managers shall be assigned by the Business Units.

Proper operation of the SharePoint environment requires specific governance, numerous policies and processes, and artifacts to guide the actions of SharePoint program staff, Business Units, and end users.

SharePoint Services interfaces with process owners to ensure IRS policies are complied with in the IRS SharePoint environment. The process owners include:

The storage of PII/SBU in SharePoint is authorized provided approval from PGLD has been obtained (prior to storing PII/SBU data) in the form of a current SP PIA.

SharePoint Services supports the creation and submission of SharePoint specific Privacy Impact Assessments (SP PIA) to Privacy, Governmental Liaison and Disclosure (PGLD) per IRM 10.5.2.2, Privacy and Civil Liberties Impact Assessment (PCLIA).

SharePoint Services is not responsible for the monitoring of SP PIA status and will rely on PGLD to notify SharePoint Services if a site is not in compliance.

The PII/SBU compliance status of a site collection must be reviewed and certified periodically by the Site Collection Administrators, per the IRS Site Management Guide in accordance with PGLD requirements.

Failure of the Business Unit and Site Collection Administrators to certify by the deadline could lead to the site being disabled or removed at the discretion of SharePoint Services and/or PGLD.

The storage of PII/SBU data is not permitted within SharePoint Development or Test environments.

Permissions should be assigned via SharePoint Groups. Direct permissions should be used when the use of groups is not feasible or practical (typically in situations when item level permissions are used as part of an automated tool). Permissions best-practices are discussed within the IRS Site Management Guide.

Site Collection permissions must be reviewed and certified periodically by the Site Collection Administrators, per the IRS Site Management Guide according to guidelines determined by SharePoint Services, approved policies, or any applicable IRMs.

Failure to certify by the deadline could lead to the Site Collection being disabled or removed at the discretion of SharePoint Services and/or CyberSecurity.

Site Collection Administrators and Owners are discouraged from making any changes to the base SP Permissions model including customizations to the Out-of-the-Box (OOB) permission levels.

All infrastructure changes made to IRS SharePoint to support permissions management are reviewed and approved by SharePoint Services.

Unless otherwise authorized by the SharePoint Services, all Site Collections must have auditing of permission changes enabled with at least a 120-day audit log retention. Site Collection Administrators are free to enable additional auditing and specify a longer retention time.

Audit Logs must be reviewed and certified periodically by the Site Collection Administrators, per the IRS Site Management Guide according to guidelines determined by SharePoint Services, approved policies, or any applicable IRMs.

Failure to certify by the deadline could lead to the site being disabled or removed at the discretion of SharePoint Services and/or CyberSecurity.

The individual IRS Business Units are responsible to ensure their SharePoint permissions and permissions auditing complies with applicable sections of the IRS IRM including; but not limited to, the following:

Records stored in SharePoint must be managed in accordance with PGLD guidelines as documented in IRM 2.25.20.2.2.1.4, SharePoint Records Management and IRM 1.15, Records and Information Management.

SharePoint Services will maintain Development, Test, Disaster Recovery, Production, and SP Custom, etc. environments as required based on the established technical architecture.

SharePoint Services establishes thresholds, limits, or other throttles to functions within the IRS SharePoint environment to reduce operational risks to uptime targets.

Any request to remove, change, or modify the environmental thresholds, limits, or throttles must be reviewed and approved by SharePoint Services via the SharePoint Change Management process (see Self-Services Standard Operating Procedures (SOP) for additional details).

SharePoint Services predefines Site Collection types to ensure that deployed sites are consistent with applicable design standards, accessibility regulations, and SharePoint recommendations.

The various types of Site Collections are defined within the IRS Site Management Guide.

SharePoint servers and all related server configurations are managed by SharePoint Services.

Requests to change configurations of components must be reviewed and approved by SharePoint Services via the SharePoint Change Management process (see Self-Services Standard Operating Procedures (SOP) for additional details).

All SharePoint infrastructure, including physical or virtual components, or any interfacing software is managed by SharePoint Services.

Infrastructure and configuration of SharePoint Technical environment is audited in compliance with applicable sections of the IRS IRM including; but not limited to, the following:

The IRS SharePoint Backup Plan provides additional details on the IRS SharePoint Disaster Recovery function.

Any external connections made to IRS SharePoint may require manual configuration disaster recovery operation.

External connections must be configured within the DR environment for disaster recovery operations to perform automatically.

External connections must be reviewed and approved by SharePoint Services prior to implementation.

All maintenance to the IRS SharePoint environment (including patching and upgrades) is performed by SharePoint Services in accordance with the documented Change Management practices (see Self-Services Standard Operating Procedures (SOP) for additional details).

Changes to the SharePoint infrastructure, the deployment of server-side managed code, and the moving of sites between environments are performed via the SharePoint Change Management process documented on SP Central.

SharePoint Services has established a set of practices and procedures that must be followed in performing customization activities.

Server-deployed custom code shall be developed consistent with the IRS SharePoint Development Standard available on SharePoint Central.

All server-deployed custom code developed by business units with the intention of deployment to the IRS SharePoint environment shall be developed in accordance to IRS Enterprise Life-Cycle (ELC) methodology (and documentation requirements).

SharePoint Services must approve all proposals for server-deployed custom code prior to development (via the SharePoint Change Control Board (SP CCB)).