Share files with the right audience
Choose a sharing method that fits both the file and the people who need it. In this fictional Northstar Works example, routine project drafts stay in a team workspace, while sensitive drafts require a restricted destination selected with the content owner.
Make four decisions before you share
If you cannot confidently answer any of these, pause and ask the content owner or IT and Security.
1. Classify the content
Identify whether the file is routine team material, confidential business information, or sensitive personal information. Use your organization’s approved classification terms when available.
- Check the file and its attachments, not only the message you plan to send.
- If sensitivity or permitted recipients are unclear, ask the content owner before sharing.
2. Choose a destination
Use an organization-approved workspace that fits the content and its audience. A convenient location is not automatically an appropriate one.
- For routine collaboration, use the team’s approved shared workspace.
- For sensitive or restricted material, confirm the appropriate destination with the content owner or IT and Security.
3. Limit access
Give access only to the people or group who need the file for the stated work. Prefer a defined audience over a link that anyone can open.
- Check who can open the file before sending the link.
- Do not reuse a broad project group for content with a narrower authorized audience.
4. Set a review point
Know who owns the file and when its audience should be checked again. Revisit access when the project, recipients, or purpose changes.
- Remove people or links that no longer need access.
- Confirm the remaining audience still matches the file’s purpose.
A worked example: project draft for review
Fictional example: the coordinator’s choice depends on what the draft contains and who needs to review it.
Routine draft for the project group
A fictional project coordinator asks six colleagues on the project team to review a routine launch-planning draft. The coordinator places it in the team’s approved shared workspace, grants access to the project group, and checks membership when the project ends.
- Audience: the six colleagues doing the review.
- Access check: the project group still matches the work.
Sensitive information in the draft
If the draft includes sensitive personal or confidential material, the same broad project group may not be appropriate. The coordinator pauses and asks the content owner or IT and Security which restricted destination and audience are suitable.
- Do not send a broad link while suitability is unresolved.
- Confirm the authorized audience before sharing.
Review access when circumstances change
Use these prompts for a review; they are general checks, not steps in a particular software system.
-
1
Identify the owner
Find the role or person responsible for the file’s content and its continued sharing.
-
2
Check the current audience
Review who can access the file and whether access is limited to the intended people or group.
-
3
Remove access that is no longer needed
Remove recipients or links that no longer support the file’s purpose, using the organization’s approved method.
-
4
Confirm the remaining audience
Check that each remaining recipient still needs the file and is an appropriate reader.
-
5
Repeat at a meaningful trigger
Review again when a project ends, the audience changes, or the file’s purpose or sensitivity changes.
Who to involve
Sender: Choose a suitable audience and sharing method, and review access when the work or audience changes.
Content owner: Help determine the file’s sensitivity, intended use, and authorized recipients.
IT and Security: Answer questions about approved sharing methods and advise on the organization’s response route if a file may have been exposed.
If you are unsure, pause before sharing and use your organization’s established IT and Security help route. If you suspect unintended access, report it through the organization’s established exposure-reporting route promptly.