Share files with the right audience

Choose a sharing method that fits both the file and the people who need it. In this fictional Northstar Works example, routine project drafts stay in a team workspace, while sensitive drafts require a restricted destination selected with the content owner.

Printed documents and folders on a desk, illustrating work files to consider before sharing.

Make four decisions before you share

If you cannot confidently answer any of these, pause and ask the content owner or IT and Security.

Content
1. Classify the content

Identify whether the file is routine team material, confidential business information, or sensitive personal information. Use your organization’s approved classification terms when available.

  • Check the file and its attachments, not only the message you plan to send.
  • If sensitivity or permitted recipients are unclear, ask the content owner before sharing.
Location
2. Choose a destination

Use an organization-approved workspace that fits the content and its audience. A convenient location is not automatically an appropriate one.

  • For routine collaboration, use the team’s approved shared workspace.
  • For sensitive or restricted material, confirm the appropriate destination with the content owner or IT and Security.
Audience
3. Limit access

Give access only to the people or group who need the file for the stated work. Prefer a defined audience over a link that anyone can open.

  • Check who can open the file before sending the link.
  • Do not reuse a broad project group for content with a narrower authorized audience.
Review
4. Set a review point

Know who owns the file and when its audience should be checked again. Revisit access when the project, recipients, or purpose changes.

  • Remove people or links that no longer need access.
  • Confirm the remaining audience still matches the file’s purpose.

A worked example: project draft for review

Fictional example: the coordinator’s choice depends on what the draft contains and who needs to review it.

Routine draft for the project group

A fictional project coordinator asks six colleagues on the project team to review a routine launch-planning draft. The coordinator places it in the team’s approved shared workspace, grants access to the project group, and checks membership when the project ends.
  • Audience: the six colleagues doing the review.
  • Access check: the project group still matches the work.

Sensitive information in the draft

If the draft includes sensitive personal or confidential material, the same broad project group may not be appropriate. The coordinator pauses and asks the content owner or IT and Security which restricted destination and audience are suitable.
  • Do not send a broad link while suitability is unresolved.
  • Confirm the authorized audience before sharing.

Review access when circumstances change

Use these prompts for a review; they are general checks, not steps in a particular software system.

  1. 1

    Identify the owner

    Find the role or person responsible for the file’s content and its continued sharing.
  2. 2

    Check the current audience

    Review who can access the file and whether access is limited to the intended people or group.
  3. 3

    Remove access that is no longer needed

    Remove recipients or links that no longer support the file’s purpose, using the organization’s approved method.
  4. 4

    Confirm the remaining audience

    Check that each remaining recipient still needs the file and is an appropriate reader.
  5. 5

    Repeat at a meaningful trigger

    Review again when a project ends, the audience changes, or the file’s purpose or sensitivity changes.

Who to involve

Sender: Choose a suitable audience and sharing method, and review access when the work or audience changes.

Content owner: Help determine the file’s sensitivity, intended use, and authorized recipients.

IT and Security: Answer questions about approved sharing methods and advise on the organization’s response route if a file may have been exposed.

If you are unsure, pause before sharing and use your organization’s established IT and Security help route. If you suspect unintended access, report it through the organization’s established exposure-reporting route promptly.