Kittitas County SOW Microsoft Purview Data Security Strategy PSA v4 20260929

Home Browse Search

Statement of Work September 29, 2026 - Version 4.0 Microsoft Purview Data Security Strategy Page 4 Design Phase • Design the compliance boundary architecture, including the RBAC role -group model that restricts each department's data handlers to their own agency's mailboxes and SharePoint sites (e.g., a "Sheriff – eDiscovery Managers" role group) • Define the Compliance Security Filter logic and naming standard for up to twenty-four (24) departmental filters keyed to the standardized Entra ID attributes and mapped SharePoint URLs • Design the Preservation in Place hold model to replace verbal and email litigation holds • Design the export configuration for deduplication and decryption to support cleaner legal review hand -off • Produce an as-built design specification for County review and approval before implementation Execute Phase • Remediate Entra ID department attributes for In-Scope users in accordance with the approved Discovery recommendations • Create and configure the RBAC role groups and assign departmental data handlers • Implement up to twenty-four (24) Compliance Security Filters and validate that each filter correctly scopes search results to the owning department's mailboxes and SharePoint sites only • Configure Preservation in Place holds and validate that content is preserved even when deleted or when a custodian departs • Enable the PRO to generate search result statistics and estimates; • Configure deduplication and decryption at export and validate output against a representative review set • Conduct end-to-end validation of the five (5) operational use cases (scoped PRA search, litigation hold, designee self-service, cleaner review hand-off, and audit defensibility) Closure Phase • Deliver as-built documentation of the implemented boundary architecture, Compliance Security Filters, hold model, and export configuration • Deliver up to two (2) ninety (90)-minute administrator enablement sessions for Central IT covering the boundary architecture and ongoing administration • Deliver up to two (2) ninety (90)-minute working sessions for departmental designees covering query construction, search statistics, and exports • Conduct a project closure review and confirm acceptance criteria are met • Provide recommendations for optional downstream phases (e.g., Premium eDiscovery review sets and predictive coding) should the County's needs grow beyond G3 • Provide Project lessons learned documentation • Complete Project closure meeting with Project team • Conduct Knowledge Transfer: o Provide an informal overview of administrative and operational functions on or before the Services completion with the necessary and identified staff available for the session • Deliver Completion Certificate and attain Client sign off *Please note: Knowledge Transfer does not replace formal system training. Knowledge transfer is delivered as part of the Services and will be four (4) sessions lasting up to ninety (90) minutes each. Client must identify necessary staff required/needed for the Knowledge Transfer session and do everything they can to have the identified resources available for the session. This transfer of knowledge will be conducted in an informal and informative way, not prepared in advance, and without creating any knowledge artifacts such as documents, diagrams or videos. A recording of the session may be done at Client’s request. If recorded, it will be distributed to the Client within three (3) business days of the completion of the Knowledge Transfer session.