The 8 Governance Domains
Engagement Models & What Drives Scope
Every health check is a fixed fee agreed before work starts — no hourly billing, and no change orders on the assessment. The fee is set by how much tenant there is to assess, not by how long it takes us. Three things move it:
What moves scope up
- Custom permission groups. A tenant with hundreds of hand-made groups and broken inheritance takes materially longer to score than one that stayed on inherited permissions.
- External collaboration in scope. B2B, guest access and partner channels each add a domain to assess and a policy set to review.
- Migration history. Tenants carrying content migrated from SharePoint Server 2010/2013 usually hold orphaned content types and legacy workflows that have to be inventoried.
- Regulated data. HIPAA, FedRAMP or CMMC obligations mean the Purview integration plan has to map to named controls rather than good practice.
What keeps it down
- An existing governance document, however out of date — it gives the scan a baseline to score against.
- Bundling with the Copilot Readiness Assessment, which shares the tenant scan and stakeholder interviews instead of repeating them.
- A named internal owner who can answer provisioning and ownership questions without a scheduling round-trip.
Microsoft licensing costs are separate and are Microsoft's published list prices, not ours — SharePoint Online and Microsoft 365 plan pricing is on Microsoft's pricing page.
FAQ
What is a SharePoint Governance Health Check?
A 3-week fixed-fee engagement that scores your SharePoint Online governance maturity across 8 domains: information architecture, permissions + sharing, content lifecycle + retention, site provisioning, naming conventions, Microsoft Purview integration, M365 group governance, external collaboration. Output: maturity scorecard + 12-month governance roadmap.
Why do enterprises need a SharePoint governance health check?
SharePoint tenants drift over time. What was a clean governance model at launch becomes 15 years of accumulated site sprawl, custom permission groups, orphaned content, duplicate sites, inconsistent naming, and missing retention policies. The health check provides an objective scorecard + roadmap to remediate before Copilot rollout amplifies governance gaps.
What are the 8 governance domains assessed?
(1) Information Architecture (taxonomy, hub sites, navigation), (2) Permissions + Sharing (group sprawl, external sharing, link policies), (3) Content Lifecycle + Retention (Microsoft Purview retention labels, deletion policies), (4) Site Provisioning (templates, request workflows, ownership), (5) Naming Conventions (sites, libraries, columns, content types), (6) Microsoft Purview Integration (sensitivity labels, DLP, eDiscovery), (7) M365 Group Governance (creation policy, expiration, naming, sponsors), (8) External Collaboration (B2B, guest access, partner channels).
How long does the SharePoint Governance Health Check take?
3 weeks fixed timeline. Week 1: tenant scan + governance artifact collection (existing policies, documentation, training). Week 2: scoring against EPC Group governance maturity model (Initial / Developing / Defined / Managed / Optimized). Week 3: roadmap + executive readout + 12-month remediation plan.
How much does the SharePoint Governance Health Check cost?
It is a fixed-fee engagement, quoted after a short discovery call rather than published as a rate card. Scope is driven by SharePoint tenant size — site count is the single biggest factor, followed by how many custom permission groups and content types have accumulated, and whether external collaboration is in scope. The fee is fixed before work starts and covers the full scorecard, 12-month roadmap and executive readout, with no hourly billing and no change orders for the assessment itself.
What is the deliverable?
4 documents: (1) Governance Maturity Scorecard (8 domains × 5-level scale), (2) Gap Analysis with prioritized findings, (3) 12-Month Governance Roadmap with phase-by-phase milestones, (4) Microsoft Purview Integration Plan (sensitivity labels, retention policies, DLP).
Can this be combined with the Copilot Readiness Assessment?
Yes, and combining them costs less than buying the two separately because the tenant scan, permissions analysis and stakeholder interviews are shared rather than repeated. The combined engagement runs 4-6 weeks and produces unified deliverables: governance, permissions, Copilot readiness, a 90-day deployment plan and the 12-month governance roadmap.
Does this include remediation execution?
No. The health check produces the plan; execution is scoped separately and priced on remediation scope. Many clients self-perform it — the EPC Group governance maturity model is open and documented specifically so an internal team can execute the roadmap without us, and that is a legitimate outcome of the engagement rather than a failed upsell.
Related
Schedule Your SharePoint Governance Health Check
3 weeks. Fixed-fee. 8-domain maturity scorecard. 12-month roadmap. 6,500+ SharePoint deployments since 2007.