The 8 Governance Domains
Engagement Models & What Drives Scope
Every health check is a fixed fee agreed before work starts — no hourly billing, and no change orders on the assessment. The fee is set by how much tenant there is to assess, not by how long it takes us. Three things move it:
What moves scope up
- Custom permission groups. A tenant with hundreds of hand-made groups and broken inheritance takes materially longer to score than one that stayed on inherited permissions.
- External collaboration in scope. B2B, guest access and partner channels each add a domain to assess and a policy set to review.
- Migration history. Tenants carrying content migrated from SharePoint Server 2010/2013 usually hold orphaned content types and legacy workflows that have to be inventoried.
- Regulated data. HIPAA, FedRAMP or CMMC obligations mean the Purview integration plan has to map to named controls rather than good practice.
What keeps it down
- An existing governance document, however out of date — it gives the scan a baseline to score against.
- Bundling with the Copilot Readiness Assessment, which shares the tenant scan and stakeholder interviews instead of repeating them.
- A named internal owner who can answer provisioning and ownership questions without a scheduling round-trip.
Microsoft licensing costs are separate and are Microsoft's published list prices, not ours — SharePoint Online and Microsoft 365 plan pricing is on Microsoft's pricing page.
FAQ
What is a SharePoint Governance Health Check?
A 3-week fixed-fee engagement that scores your SharePoint Online governance maturity across 8 domains: information architecture, permissions + sharing, content lifecycle + retention, site provisioning, naming conventions, Microsoft Purview integration, M365 group governance, external collaboration. Output: maturity scorecard + 12-month governance roadmap.
Why do enterprises need a SharePoint governance health check?
SharePoint tenants drift over time. What was a clean governance model at launch becomes 15 years of accumulated site sprawl, custom permission groups, orphaned content, duplicate sites, inconsistent naming, and missing retention policies. The health check provides an objective scorecard + roadmap to remediate before Copilot rollout amplifies governance gaps.
What are the 8 governance domains assessed?
(1) Information Architecture (taxonomy, hub sites, navigation), (2) Permissions + Sharing (group sprawl, external sharing, link policies), (3) Content Lifecycle + Retention (Microsoft Purview retention labels, deletion policies), (4) Site Provisioning (templates, request workflows, ownership), (5) Naming Conventions (sites, libraries, columns, content types), (6) Microsoft Purview Integration (sensitivity labels, DLP, eDiscovery), (7) M365 Group Governance (creation policy, expiration, naming, sponsors), (8) External Collaboration (B2B, guest access, partner channels).
How long does the SharePoint Governance Health Check take?
3 weeks fixed timeline. Week 1: tenant scan + governance artifact collection (existing policies, documentation, training). Week 2: scoring against EPC Group governance maturity model (Initial / Developing / Defined / Managed / Optimized). Week 3: roadmap + executive readout + 12-month remediation plan.
How much does the SharePoint Governance Health Check cost?
It is a fixed-fee engagement, quoted after a short discovery call rather than published as a rate card. Scope is driven by SharePoint tenant size — site count is the single biggest factor, followed by how many custom permission groups and content types have accumulated, and whether external collaboration is in scope. The fee is fixed before work starts and covers the full scorecard, 12-month roadmap and executive readout, with no hourly billing and no change orders for the assessment itself.
What is the deliverable?
4 documents: (1) Governance Maturity Scorecard (8 domains × 5-level scale), (2) Gap Analysis with prioritized findings, (3) 12-Month Governance Roadmap with phase-by-phase milestones, (4) Microsoft Purview Integration Plan (sensitivity labels, retention policies, DLP).
Can this be combined with the Copilot Readiness Assessment?
Yes, and combining them costs less than buying the two separately because the tenant scan, permissions analysis and stakeholder interviews are shared rather than repeated. The combined engagement runs 4-6 weeks and produces unified deliverables: governance, permissions, Copilot readiness, a 90-day deployment plan and the 12-month governance roadmap.
Does this include remediation execution?
No. The health check produces the plan; execution is scoped separately and priced on remediation scope. Many clients self-perform it — the EPC Group governance maturity model is open and documented specifically so an internal team can execute the roadmap without us, and that is a legitimate outcome of the engagement rather than a failed upsell.
Related
Schedule Your SharePoint Governance Health Check
3 weeks. Fixed-fee. 8-domain maturity scorecard. 12-month roadmap. 6,500+ SharePoint deployments since 2007.
Documented and anonymized engagements
Named engagements come first; anonymized summaries follow under the anonymized-engagement rule — the client is not named and every statement is EPC-reported. Documents behind named engagements are in the Evidence Center.
- Samsung Semiconductor, Inc. — SharePoint Server 2019 build and deployment: custom user experience, navigation, web parts, search, enterprise-application integration, quality assurance and training (2021)Samsung Semiconductor, Inc. · 2021 · Contracted — countersigned
- Canadian Forces Morale & Welfare Services (CFMWS) — SharePoint consulting support (2014)Canadian Forces Morale & Welfare Services (CFMWS) · 2014 · Contracted
- Stryker Corporation — SharePoint Center of Excellence development (2012)Stryker Corporation · 2012 · Delivered — payment-corroborated (client payment records published)
- Federal Reserve Bank of New York — SharePoint best-practices needs assessment, architecture and governance gap analysis, roadmap for a global SharePoint Center of Excellence across the twelve Reserve Bank districts (2010)Federal Reserve Bank of New York · 2010 · Contracted — countersigned, with historical work product
- Copilot and SharePoint AI Governance: Regional Bank (2024)Anonymized engagement summary · Regional bank · 2024Engagement phase: governance and readiness planning before a Copilot rollout; no rollout is reported
- SharePoint Intranet Permission Automation: Contractor (2024)Anonymized engagement summary · Federal government contractor · 2024
- Two SharePoint Farms to SharePoint Online: Regional BankAnonymized engagement summary · Regional bank · 2024
- SharePoint Health Check, Upgrade and Support: ManufacturerAnonymized engagement summary · Consumer-products manufacturer · 2017–2023
More engagements: NASA (agency-wide, across the NASA Centers) — Agency SharePoint Phase 1 Initiative: needs assessment, architectural review, governance, and a global SharePoint Center of Excellence for knowledge management, intranet and enterprise content management across the NASA Centers (2009–2010) · National Archives and Records Administration (NARA) — SharePoint records management and Center of Excellence advisory and implementation support (2010) · National Institutes of Health — SharePoint Center of Excellence design (2010) · Northrop Grumman — 'Finance I.R.M. Automation Process' statement of work on SharePoint (2010) · NASA Johnson Space Center — SharePoint Site Provisioning Solution (2009) · YMCA (Houston) — Microsoft Office SharePoint Server 2007 implementation (2007) · SharePoint Support and Custom Apps: Professional Services · SharePoint 2010 to 2019 Migration: Regional Bank (2020) · SharePoint Online Document Management: Transportation (2020) · SharePoint 2010 to Online Design: Global Law Firm (2018) · SharePoint 2016 Intranet Redesign: Energy Company (2018) · SharePoint Intranet Redesign: Financial Services · SharePoint Migration: Major Healthcare Network