1. Assessing new Teams capabilities

Challenge: Difficult to stay on top of a steady stream of new Teams capabilities

Best practices:

• Follow the product blogs and monitor the RSS feeds for Microsoft rollouts, so everyone has an idea of what's coming out
• Know what is coming up so you can put policies in place before end-users download or take unapproved action
• Continually reassess functionality; conduct rigorous testing and risk acceptance practices

2. Teams rollout

Challenges:

• Understanding the impact of changes to underlying systems (e.g., group membership, links vs. attachments)
• New Teams features often defaulted on
• Some are finding inconsistencies; Teams creates a record in some cases, not in others (i.e., an internal person joins an external Team meeting)

Best Practices:

• Set up a steering committee with stakeholders from compliance and legal departments to work with the IT teams on the new rollout
• Use steering committee to build a plan to react to new Teams releases
• Take a methodical and cautious approach to rollout and minimize trial and error
• Ensure that your firm understands the entire Microsoft 365 suite and not just one component (like Teams)
• Build and follow checklists to guide incremental rollouts

3. Change management

Challenge: How will you move from deployment to full-scale adoption?

Best practices:

• Training must include policies, procedures and technology controls
• Plan for the end game: one firm plans to start and track all conversations in Teams to reduce meetings

4. Employee training

Challenges:

• Initial deployments can be driven by sub-groups (like IT), then followed with other groups without proper training
• Some users are not technical, and won't invest time to learn new features

Best Practices:

• Training should be extensive, role-specific, and targeted to new Teams features 
• Practice over-communication to minimize self-training burden on users
• Adjust supervisory policies for regulated users on Teams, and consider periodic inspections of non-regulated users to identify potential policy infractions

5. Policy controls

Challenge: New Teams features are often released before the availability of technology policy controls

Best practices:

• "Trust but verify" is a good strategy if relying solely upon individual actions, but should be complemented with periodic inspection
• Absent available technology controls, firms should invest in policies and procedures to ensure that employees know what they can and cannot do
• Define policies for regulated and non-regulated users
• An emerging tactic is to split employees into two groups, and either turn off capabilities or define prohibition policies for regulated users

6. Regulatory guidance

Challenge: Unclear guidance from regulators (to date) on how firms should be capturing and supervising new capabilities such as whiteboards and voice recordings

Best practices:

• FINRA & SEC have published guidance and FAQs on expectations of how firms can monitor tech being used during the pandemic
• Regulators are spot-checking the use of new features
• Must retain new capabilities if they are being used by regulated individuals; it is a different decision to determine if they constitute a record for non-regulated users