Microsoft Teams, SharePoint, OneDrive, Exchange, and Microsoft 365 — engineered for HIPAA, FINRA, SEC, FedRAMP, CMMC, and GxP. Information Barriers, Communication Compliance, Purview, Audit Premium, lifecycle automation.
By Errin O'Connor, Founder & Chief AI Architect, EPC Group
EPC Group's Modern Workplace + Teams Governance practice deploys Microsoft Teams, SharePoint, OneDrive, Exchange, and Microsoft 365 with the governance, audit, and lifecycle controls required by HIPAA, FINRA, SEC, FedRAMP, CMMC, GxP, and the EU AI Act. Information Barriers, Communication Compliance, Purview labeling, Audit Premium retention, lifecycle automation, and SharePoint information architecture — all configured before broad license assignment.
A generic Microsoft Teams rollout enables external sharing, ships a SharePoint hub, and stops. A regulated tenant requires Microsoft Purview labels propagating from Teams to SharePoint to OneDrive to Exchange, Information Barriers preventing research from chatting with investment banking, Communication Compliance applying FINRA Rule 3110 supervisory review to every Teams message and Exchange email, Audit Premium retention at 7-10 years, and lifecycle automation that ensures Microsoft 365 Groups are deprovisioned when their owner leaves.
EPC Group configures all of these as first-order requirements at Day 1 — not bolted on six months later when the regulator asks for an evidence package. See the EPC Group Governed AI on Microsoft Framework for how this Modern Workplace governance layer connects to Microsoft 365 Copilot and Microsoft Fabric deployment.
Six named, fixed-fee offerings covering the governance, audit, and lifecycle stack required by regulated tenants.
8-12 weeks · Fixed-fee, scoped
Segment design (research / investment banking / clinical / administrative / CUI / non-CUI), policy deployment for Teams + SharePoint + Exchange + OneDrive, audit log review, regulator-ready evidence package.
6-10 weeks · Fixed-fee, scoped
FINRA Rule 3110 supervisory review on Teams + Exchange + Viva Engage + Copilot-generated content. Custom classifiers, reviewer queues, escalation workflow, Sentinel integration.
8-12 weeks · Fixed-fee, scoped
Label taxonomy (Public / Internal / Confidential / Highly Confidential / Regulated), auto-classification rules, container labels on SharePoint and Teams workspaces, propagation to OneDrive + Exchange + Copilot grounding.
4-8 weeks · Fixed-fee, scoped
7-10 year audit retention per HIPAA / FINRA 4511 / SEC 17a-4(f) / FedRAMP High / GxP. Retention labels on every regulated content type. eDiscovery Premium with legal hold workflow tested at deployment.
6-10 weeks · Fixed-fee, scoped
Group expiration policies, naming conventions, sensitivity-label-aware provisioning, Identity Governance access reviews, sponsor re-attestation for guest accounts.
8-12 weeks · Fixed-fee, scoped
Departing-employee, data-theft, and policy-violation analytics tuned to Teams + SharePoint + OneDrive behaviors. False-positive tuning, case management integration, Sentinel detection rules.
Mapping between Microsoft Modern Workplace components and statutory controls per industry.
Information Barriers between research and investment banking. Communication Compliance for FINRA Rule 3110 + SEC Rule 17a-4(f). MNPI labeling. SIPC / FINRA Audit Premium retention. Tested 17a-4(f) evidence export.
Information Barriers between clinical and administrative. PHI sensitivity labels propagated from Teams to SharePoint to OneDrive to Exchange. BAA-verified configuration. Audit Premium 7-year retention. Microsoft Restricted SharePoint Search for Copilot.
Microsoft 365 GCC or GCC High deployment. CUI banner-aware sensitivity labels. NIST 800-53 / 800-171 control mapping. CMMC 2.0 Level 2/3 alignment. Information Barriers for CUI / non-CUI separation. IL4 / IL5 boundary enforcement.
21 CFR Part 11 / FDA Annex 11 alignment. Validated Teams workspaces for clinical-trial communication. Clinical-trial data isolation. Audit Premium retention tied to regulatory clock for clinical phase.
A generic Microsoft Teams rollout configures licensing, enables external sharing at the tenant level, and ships. A regulated tenant requires Information Barriers (so research cannot chat with investment banking, so clinical cannot share with administration on PHI), Communication Compliance (FINRA Rule 3110 supervisory review on every Teams message and Exchange email, including Copilot-generated content), Purview labels that flow from Teams to SharePoint to OneDrive to Exchange, Audit Premium retention at 7-10 years, and lifecycle automation that ensures groups are deprovisioned when no longer needed. EPC Group configures all of these as first-order requirements at Day 1.
Information Barriers (IB) policies prevent two groups of users from communicating with each other in Teams chat, channel messages, and SharePoint site access. EPC Group designs IB segments based on regulatory boundary (research vs investment banking for SEC/FINRA, clinical vs administrative for HIPAA, CUI vs non-CUI for CMMC), then deploys policies that enforce: no Teams chat between segments, no @-mentions across segments, no SharePoint site access across segments, no Exchange email distribution group cross-membership. Audit logs capture every blocked attempt for regulator review.
Microsoft Purview Communication Compliance applies supervisory review to Teams chats, channel messages, Exchange email, Yammer/Viva Engage posts, and Microsoft 365 Copilot-generated content. EPC Group configures policies aligned to FINRA Rule 3110 (broker-dealer supervisory review), HIPAA workforce communication review, SEC Rule 17a-4(f) tamper-evident retention, and customer-specific regulatory baselines. Reviewer queues, escalation paths, and case management integrate with Microsoft Sentinel and Insider Risk Management.
SharePoint IA for regulated tenants requires container labels at the site level, sensitivity labels at the document level, hub site federation for governance reporting, search permission scoping (Microsoft Restricted SharePoint Search for Copilot), and a quarterly access-review cadence on every site provisioning. EPC Group ships a published IA standard, deploys Microsoft Purview to enforce label propagation, configures Microsoft Search permission scopes, and builds the access-review automation as part of the engagement Statement of Work.
EPC Group standard timeline: Discovery (4-6 weeks, fixed-fee) covers IB segmentation design, Communication Compliance scope, label taxonomy, and Audit Premium baseline. Foundation Build (12-16 weeks, fixed-fee) deploys IB policies, Communication Compliance, sensitivity labels at 80% coverage on regulated content, Audit Premium retention, and Microsoft 365 Group lifecycle automation. Enterprise Build (20-32 weeks, fixed-fee) adds multi-business-unit IB federation, advanced Communication Compliance ML models, Identity Governance access reviews, and Copilot governance integration.
The Modern Workplace governance layer is the foundation that makes Copilot deployable in regulated tenants. Information Barriers prevent Copilot from grounding across segment boundaries. Communication Compliance applies supervisory review to Copilot-generated chats and emails. Purview labels propagate to Copilot grounding so Restricted-tier content is blocked at AI grounding time. Audit Premium captures every Copilot prompt and response with 7-10 year retention. See the EPC Group [Governed AI on Microsoft Framework](/governed-ai-microsoft-framework) for the full integration.
Senior architects (not sales) take discovery calls. Fixed-fee Discovery available before any larger commitment.
AI assistant — not human