# Control 4.3: Site and Document Retention Management

**Control ID:** 4.3<br>
**Pillar:** SharePoint<br>
**Regulatory Reference:** FINRA 4511, FINRA 3110, FINRA RN 24-09, SEC 17a-3/4, GLBA 501(b), SOX 404/802<br>
**Last UI Verified:** April 2026<br>
**Governance Levels:** Baseline / Recommended / Regulated<br>

---

## Objective

Manage the lifecycle of SharePoint sites and documents to ensure proper retention for regulatory compliance and timely disposition of content no longer needed. This helps prevent AI agents from surfacing stale or outdated information that could lead to regulatory violations or poor customer outcomes.

---

## Why This Matters for FSI

- **FINRA 4511 / RN 24-09 / Rule 3110:** FINRA Rule 4511 requires retention of books and records per regulatory timelines; FINRA Regulatory Notice 24-09 and Rule 3110 extend supervisory expectations to AI-generated content. (FINRA RN 25-07 addresses workplace modernization, not AI governance — see [framework/regulatory-framework.md](../../framework/regulatory-framework.md).)
- **SEC 17a-4(b)(4):** Communications retention (3 years, first 2 years readily accessible)
- **SEC 17a-4(a):** Financial/accounting records retention (6 years, first 2 years readily accessible)
- **SEC 17a-4:** Non-rewriteable, non-erasable storage requirements; preservation lock blocks modification
- **SOX 802 / SEC Rule 2-06:** 7-year retention for audit workpapers and financial records[^1]
- **GLBA 501(b):** Requires administrative, technical, and physical safeguards for customer information; retention policies support secure access controls for protected records

[^1]: SOX Section 802 (18 USC §1520) mandates retention of audit workpapers for "not less than 5 years." The 7-year retention period commonly cited in practice derives from SEC Rule 2-06 of Regulation S-X, which implements and extends the statutory minimum.

!!! info "Retention Periods"
    Agent conversation logs typically qualify as communications (3-year retention). See [Control 1.9 - Data Retention and Deletion Policies](../pillar-1-security/1.9-data-retention-and-deletion-policies.md) for complete retention period matrix by record type.

---

!!! info "No companion solution by design"
    Not all controls have a companion solution in [FSI-AgentGov-Solutions](https://github.com/judeper/FSI-AgentGov-Solutions); solution mapping is selective by design. This control is operated via native Microsoft admin surfaces and verified by the framework's assessment-engine collectors. See the [Solutions Index](../../reference/solutions-index.md#coverage-scope) for the catalog and coverage scope.


## Control Description

This control establishes policies and procedures for managing SharePoint site lifecycles and document retention. For agent governance, retention management helps ensure AI agents access current, compliant content while expired or outdated materials are appropriately archived or disposed.

| Capability | Description |
|------------|-------------|
| **Inactive Site Policies** | Identify and manage sites with no recent activity |
| **Site Ownership Policies** | Ensure all sites have active, identified owners |
| **Document Retention Labels** | Apply regulatory retention periods to content |
| **Disposition Workflows** | Review and approve content deletion |
| **Agent Content Freshness** | Flag stale content to prevent agent access |

---

## Key Configuration Points

- Configure inactive site policies in **SharePoint Admin Center > Policies > Site lifecycle management** (90+ day inactivity threshold) with owner notification and graduated enforcement (notify → read-only → archive)
- Create site ownership policies to identify and remediate orphaned sites before they become unmanaged knowledge sources for AI agents
- Set OneDrive retention to 365 days minimum for regulated organizations (SharePoint Admin Center > Settings > OneDrive)
- Create retention labels in Microsoft Purview for FINRA-aligned (6-year), SEC communications (3-year), SEC financial records (6-year), and SOX/Reg S-X (7-year) content
- Publish retention labels to SharePoint and OneDrive via label policies; auto-apply via sensitivity, KQL query, or trainable classifier where available
- Apply **preservation lock** to retention policies covering SEC 17a-4(f) electronic-records scope so the policy cannot be disabled, shortened, or deleted
- Coordinate with eDiscovery (Control 1.19) so legal holds override retention deletion and content-on-hold remains preserved
- Document retention coverage for every site flagged as a Copilot or agent knowledge source

---

## Technical Implementation Notes

### Dual Retention Strategy

Implement both retention policies and retention labels for comprehensive lifecycle management:

| Mechanism | Scope | Purpose |
|-----------|-------|---------|
| **Retention Policies** | Container-level (entire sites) | Automatic deletion of stale content after defined period |
| **Retention Labels** | Item-level (individual documents) | Override policies for records requiring longer retention |

Retention policies ensure stale content is removed (improving Copilot response quality), while retention labels preserve authoritative records that must be retained for regulatory examination.

### Site Lifecycle Policy (SAM Feature)

Site Lifecycle Policy is a SharePoint Advanced Management capability that detects inactive sites, notifies owners, and can automatically archive, set to read-only, or delete sites based on inactivity thresholds. This feature is distinct from retention policies and focuses on site-level governance rather than document-level retention.

### Microsoft 365 Copilot Interaction Retention

M365 Copilot interactions (prompts and responses) are retained in the user's Exchange Online mailbox, separate from SharePoint document retention. Configure Exchange retention policies to retain Copilot interactions for the required regulatory period. Copilot interactions in Teams channels follow Teams retention policies.

### Impact on Copilot Knowledge Quality

Retention policies that delete stale content improve Copilot response quality by removing "ROT" (Redundant, Obsolete, Trivial) content from the Semantic Index. Consider implementing 2-year retention-then-delete policies for non-regulated content to maintain knowledge source freshness.

---

## Zone-Specific Requirements

| Zone | Requirement | Rationale |
|------|-------------|-----------|
| **Zone 1** (Personal) | Baseline retention where tenant-wide safety applies; document exceptions | Low risk; minimal friction for personal productivity |
| **Zone 2** (Team) | Agent knowledge sources follow retention rules; require owner and approval trail | Shared agents increase blast radius; controls must be provable |
| **Zone 3** (Enterprise) | Strictest configuration; policy-enforced retention; change-controlled modifications | Highest audit/regulatory risk; enterprise agents need compliant content |

---

## Roles & Responsibilities

| Role | Responsibility |
|------|----------------|
| SharePoint Admin | Configure site lifecycle policies and tenant settings |
| Purview Compliance Admin | Create and manage retention policies and labels |
| Purview Records Manager | Manage file plan and disposition workflows |
| AI Governance Lead | Ensure agent knowledge sources have proper retention |

---

## Related Controls

| Control | Relationship |
|---------|--------------|
| [4.1 - Information Access Governance](4.1-sharepoint-information-access-governance-iag-restricted-content-discovery.md) | IAG and Restricted Content Discovery govern which content AI agents can access; retention policies complement by managing content lifecycle |
| [4.2 - Site Access Reviews](4.2-site-access-reviews-and-certification.md) | Access reviews align with retention periods |
| [1.7 - Audit Logging](../pillar-1-security/1.7-comprehensive-audit-logging-and-compliance.md) | Track retention policy events |
| [1.19 - eDiscovery](../pillar-1-security/1.19-ediscovery-for-agent-interactions.md) | Legal holds override retention deletion |

---

## Implementation Playbooks

!!! info "Step-by-Step Implementation"

    This control has detailed playbooks for implementation, automation, testing, and troubleshooting:

    - [Portal Walkthrough](../../playbooks/control-implementations/4.3/portal-walkthrough.md) — Step-by-step portal configuration
    - [PowerShell Setup](../../playbooks/control-implementations/4.3/powershell-setup.md) — Automation scripts
    - [Verification & Testing](../../playbooks/control-implementations/4.3/verification-testing.md) — Test cases and evidence collection
    - [Troubleshooting](../../playbooks/control-implementations/4.3/troubleshooting.md) — Common issues and resolutions

---

## Verification Criteria

Confirm control effectiveness by verifying:

1. Inactive site policy is configured and enabled in SharePoint Admin Center
2. Site ownership policy identifies orphaned sites and triggers remediation
3. Retention labels are published and visible to users in document libraries
4. OneDrive retention is set to 365 days or greater for regulated environments
5. Retention policies apply to agent knowledge source sites
6. Disposition workflows trigger review before content deletion

---

## Additional Resources

- [Site lifecycle management overview](https://learn.microsoft.com/en-us/sharepoint/site-lifecycle-management)
- [Retention policies for SharePoint and OneDrive](https://learn.microsoft.com/en-us/purview/retention-policies-sharepoint)
- [Create and configure retention labels](https://learn.microsoft.com/en-us/purview/create-retention-labels-data-lifecycle-management)
- [Use preservation lock for regulatory requirements](https://learn.microsoft.com/en-us/purview/retention-regulatory-requirements)

---

*Updated: May 2026 | Version: v1.6.2 | UI Verification Status: Current*
