Portal Walkthrough: Control 2.13 - Documentation and Record Keeping

Last Updated: January 2026 Portal: SharePoint, Microsoft Purview Estimated Time: 4-6 hours

Prerequisites

SharePoint Admin role
Purview Records Manager role
Retention requirements documented per FINRA 4511
Document taxonomy defined

Step-by-Step Configuration

Step 2: Configure Document Metadata

Create site columns:
Agent ID (text)
Document Category (choice: Configuration, Log, Approval, Incident, Decision)
Regulatory Reference (choice: FINRA 4511, SEC 17a-4, SOX 404, GLBA)
Retention Period (choice: 3 years, 6 years, 7 years, Permanent)
Classification Date (date)
Create content types using site columns
Apply content types to libraries

Step 3: Configure Retention Labels

Open Microsoft Purview
Navigate to Records management > File plan
Create retention labels:

Label	Retention	Action	Apply To
FSI-Agent-6Year	6 years	Delete	Agent records
FSI-Agent-7Year	7 years	Delete	Regulatory records
FSI-Agent-Permanent	Permanent	None	Critical governance

Publish labels to AI Governance site

Step 4: Configure SEC 17a-4 Compliant Storage (Zone 3)

Per the October 2022 SEC amendments (effective May 2023), broker-dealers can choose either WORM storage or an audit-trail alternative.

Option A: WORM Storage (Azure Immutable Blob)

Open Azure Portal
Create storage account with immutability:
Enable blob versioning
Configure immutability policy (time-based)
Set retention period: 6+ years
Configure Purview to use immutable storage

Option B: Audit-Trail Alternative

Ensure complete audit trail of all record access and modifications
Implement integrity verification mechanisms
Document procedures demonstrating modification detection capability
Consult compliance/legal for specific implementation requirements

Step 5: Configure Auto-Labeling

In Purview > Auto-labeling:
Create policy for agent interaction logs:
Condition: Location = AI Governance site
Condition: Content type = Interaction Log
Action: Apply FSI-Agent-6Year label
Enable policy

Step 6: Create Examination Response Procedures

Document procedures for regulatory examination: 1. Designated custodians and contact info 2. Search procedures for agent records 3. Export and production process 4. Chain of custody documentation

Configuration by Governance Level

Setting	Baseline (Zone 1)	Recommended (Zone 2)	Regulated (Zone 3)
Retention	3 years	6 years	6-7 years
Metadata	Basic	Comprehensive	Full taxonomy
Auto-Labeling	None	Recommended	Required
SEC 17a-4	N/A	N/A	WORM or audit-trail
Audit	Annual	Quarterly	Monthly

FSI Example Configuration

Document Management: AI Governance Records

SharePoint Site: https://tenant.sharepoint.com/sites/AI-Governance

Libraries:
  - AgentConfigurations: Manifest exports, prompt versions
  - InteractionLogs: Conversation transcripts
  - ApprovalRecords: Deployment approvals, change requests
  - IncidentReports: Security incidents, compliance issues
  - GovernanceDecisions: Policy decisions, risk acceptances

Retention:
  Default: 6 years
  SEC 17a-4 content: 7 years (6-year requirement + 1-year buffer; WORM or audit-trail alternative)
  Permanent: Board approvals, critical decisions

Auto-Labeling:
  Enabled: Yes
  Scope: All libraries
  Default Label: FSI-Agent-6Year

Examination Readiness:
  Custodian: [Name]
  Backup: [Name]
  Response SLA: 48 hours

Validation

After completing these steps, verify:

SharePoint site hierarchy created
Metadata columns and content types configured
Retention labels published and applied
SEC 17a-4 compliant storage configured (WORM or audit-trail, Zone 3)
Examination procedures documented

Back to Control 2.13 | PowerShell Setup | Verification Testing | Troubleshooting