Storing and Sharing Files Securely at the University of Oregon

Overview

Microsoft OneDrive and SharePoint are the preferred storage location for University of Oregon data. They both provide secure, resilient, and collaborative ways to store and share university information. While saving files directly to a computer may sometimes be appropriate, storing files in approved Microsoft 365 services can improve accessibility, collaboration, and protection against data loss or data breach.

This article provides guidance for choosing where to store files and how to share them securely.

Why use OneDrive or SharePoint?

You should consider storing work-related files containing university information in University of Oregon provided OneDrive or SharePoint rather than solely on a local device.

Benefits may include:

Improved accessibility

Files stored in OneDrive or SharePoint can be accessed from multiple devices and locations, making it easier to work remotely, collaborate with others, and continue working when changing computers.

Better collaboration

Microsoft 365 services allow multiple people to work on the same document, reducing the need to email copies back and forth and helping teams work from a single source of truth.

Increased resilience

Files stored only on a computer may be lost if the device is damaged, lost, stolen, or experiences a hardware failure.
While cloud storage should not be considered a backup solution, storing files in OneDrive or SharePoint can provide greater resilience than relying solely on local storage.

Security features

University-provided Microsoft 365 services include security controls and access management capabilities that can help protect institutional data when used appropriately.

Choosing the right storage location

OneDrive

OneDrive is generally a good choice for:

• Individual work files
• Draft documents
• Personal work spaces
• Files that are occasionally shared with others

SharePoint

SharePoint is a good choice for:

• Team Documents
• Departmental Information
• Shared Projects
• Files that should remain available even if an individual leaves the university or changes roles

Local storage

Saving files locally may be appropriate in some situations. However, files stored only on a computer can be more vulnerable to loss and may be difficult to access from other devices.

Research and specialized data

Some research datasets, scientific data, media collections, and other specialized files may be too large or otherwise unsuitable for storage in OneDrive or SharePoint.
Researchers and departments should use storage solutions that are appropriate for the size, sensitivity, and operational requirements of their data.

Sharing files securely

Whenever possible, share files using Microsoft 365 sharing features rather than sending file attachments through email. Sharing links can help ensure collaborators are working from the most current version of a document.

Understand sharing permissions

By default, university provided OneDrive and SharePoint create sharing links that:

• Are limited to specific people
• Provide view-only access

These defaults help reduce the risk of unintentionally granting excessive access.

Users can modify sharing settings when appropriate to support collaboration.

Examples include:

• Granting edit access when collaborators need to make changes
• Sharing with additional individuals who require access
• Removing access when it is no longer needed

Use edit permissions carefully

When granting edit permissions:

Preferred: Grant edit access to specific named individuals.

Use caution: Broadly accessible links may provide more access than intended and can make it difficult to determine who has access to a document.

As a general practice, links that allow editing should be shared only with the specific people who need to modify the content.

Handling sensitive information

OneDrive and SharePoint may be used to store and share university information when the information is handled appropriately for its classification, the access permissions are limited to those with a legitimate need, and any applicable legal, contractual, regulatory, or research requirements are followed.

University information should be classified and protected according to UO's Information Asset Classification & Management policy. The classification helps determine who may access the information, how it should be shared, and what safeguards are appropriate.

As a general rule, do not decide where to store or how to share a file based only on the tool being used. Instead, consider the data classification, the audience, the purpose for access, and whether additional safeguards or approvals are required.

• Public information is intended for broad access or release. It may be stored or shared in OneDrive or SharePoint, but users should still confirm that the information is appropriate to release and that the integrity of the information is maintained.
• Internal information should be shared only with people who have a university business, academic, research, or operational need to access it. Use specific people or appropriate groups when sharing, avoid overly broad links, and review access periodically.
• Sensitive or restricted information requires additional care. Access should be limited to authorized individuals, sharing should be purposeful and documented where appropriate, and users should follow any applicable requirements for regulated data, research data, contractual data, or other information that could create risk if disclosed or modified without authorization.

If you are unsure how information is classified or whether additional safeguards are required, consult the applicable data owner, steward, supervisor, research sponsor, or the Information Security Office before sharing or storing the information.

Need help?

For more information, see Information Security Engagement Request or select Create a Ticket from this page.