Follow the questions in order before sharing. Use the access-review table to close or renew an existing arrangement.
- What information is required for the purpose? Reduce the scope where possible.
- Who specifically needs it? Confirm recipient identity and authority.
- Which approved location and access model fit the sensitivity?
- Can the recipient forward, download, edit, or reshare? Verify the actual configuration.
- What ends access: a date, project event, or relationship change?
- Who will review and remove access, and how will removal be verified?
Arrangement
Information / purpose / workspace:
Sensitivity classification and any agreement that governs the sharing (confidentiality agreement, side letter, regulatory limit):
Approved sharing method (named external account, guest account, expiring link, data room) and why it fits the sensitivity:
Owner / initial check date:
Default expiry applied and the exception process for extending it:
Recipients
| Recipient (person and organization) | Permission | Purpose still current? | End trigger / date | Keep, change, or remove | Verified result / date |
|---|---|---|---|---|---|
Checks
- [ ] The recipient's identity was confirmed through a channel other than the one that requested access.
- [ ] Access was tested from an external account and only the intended content was visible.
- [ ] Download, print, and reshare settings match the decision; watermarking or view-only applied where available.
- [ ] Sharing activity (views, downloads, reshares) is visible in a log the owner can read.
- [ ] The arrangement is recorded in the firm's register of external shares.
- [ ] The procedure for a mistaken share (who is told, what is revoked, what is recorded) is known to the owner.
Observed external-recipient test:
Download / copying limitations:
Retention decision for the workspace:
Periodic review of all external shares
| Measure | Value | Date |
|---|---|---|
| Active external shares and guests | ||
| Shares past their end trigger | ||
| Shares with no recorded owner | ||
| Anonymous or organization-wide links found |
Common failure modes
- A link meant for one person is forwarded and keeps working.
- Guest accounts outlive the project because nobody owns their removal.
- The register is not updated when the share is created, so the review starts from the platform's own list.
- Removal is recorded as done without a test from the recipient's side.
Next review / owner:
Removing access prevents future use only to the extent supported by the platform. Record known downloaded or unmanaged-copy limitations rather than claiming recall.
This review covers sharing the firm initiates. It does not cover information received from others under their terms, or bulk transfers governed by a data-processing agreement.