NetDocuments Workspace Security Manager (WSM) is the NetDocuments capability for creating standardized security policies and applying them to workspaces, so ethical walls and need-to-know restrictions are assigned consistently across hundreds or thousands of matters. Authorized users build a policy once, apply it wherever it fits, and report on who can reach each workspace. For firms and legal departments that currently lock down sensitive matters one workspace at a time, WSM turns security assignment into a repeatable, auditable process.
What is NetDocuments Workspace Security Manager?
NetDocuments Workspace Security Manager is a workspace-level policy tool that lets authorized users create, edit, and apply security policies to workspace content, build ethical walls, and generate workspace security reports. It sits in the NetDocuments Security Center alongside data loss prevention, encryption key management, and advanced authentication, and availability depends on your subscription.
The problem it solves is scale. A cabinet with 3,000 matter workspaces might hold 200 that need restricted access at any one time. Securing each by hand means an administrator adds names, sets rights, and remembers to remove people when the team changes. Over a year, that produces dozens of small drifts nobody notices. WSM replaces that manual work with a short list of approved policies that carry the same rules every time they are applied.
How does a WSM security policy work?
A WSM security policy works by combining two required elements: the users or groups who may access a workspace with their assigned permissions, and a configured set of controls that govern the workspace and its content. Once applied, the policy decides access for every document in that workspace.
For members, assign groups wherever possible and named users only where a matter needs them, and grant the minimum right each role needs, with View as the default and Edit, Share, or Administer only where the job requires it. For controls, record why each setting was chosen and which business or regulatory requirement it serves, so a reviewer two years from now can follow the reasoning.
Users can also see at a glance which security applies to a workspace. That view helps with review, and formal access testing still needs its own scripts.
When does a firm or legal department need WSM?
A firm or legal department needs WSM when restricted workspaces are numerous enough, or sensitive enough, that manual security assignment becomes a risk. The tipping point for most teams is somewhere between 50 and 100 restricted workspaces, or the first time an ethical wall has to be proven to a client or regulator. The cost of getting it wrong is high: the 2026 edition of a long-running global study puts the average cost of a data breach at $4.99 million, a record high.
- Ethical walls and investigations. Conflicts, adverse-party matters, internal investigations, and whistleblower reviews need segregated environments that stay sealed as staff join and leave.
- Need-to-know matters. Board matters, HR files, and confidential transactions should be limited to a named team.
- Delegated management. WSM lets approved business owners manage those policies without full administrator rights.
If you already run confidential HR and legal documents in restricted NetDocuments cabinets, WSM is the step that brings workspace-level policy and reporting on top of that structure.
How does WSM fit with other NetDocuments security controls?
WSM fits with other NetDocuments security controls by adding policy-based governance at the workspace level, above the broad access set at the cabinet. Each control handles a different layer, and a sound design uses them together.
- Cabinet security. Cabinet-level groups set the baseline for who can reach the cabinet at all. WSM then narrows access inside individual workspaces.
- Profile-based security. Profile-based security and Absolute access restrict documents by metadata such as client or matter. WSM complements this when access should follow a managed, reportable policy.
- Collaboration and data controls. CollabSpaces let outside parties work on shared documents without DMS access, handling the external boundary, data loss prevention restricts what authorized users can download or share, and advanced authentication confirms identity before any policy is checked.
Encryption key management governs keys and has no effect on who can open a workspace, so keep it out of access-design discussions.
What policies belong in a WSM policy library?
A WSM policy library should hold a small set of reusable policies, usually five to eight, that cover every recurring confidentiality pattern in your organization. One-off policies should be rare exceptions reserved for matters with unique confidentiality or regulatory needs.
- Standard and restricted matters. A standard policy covers routine work with the assigned team and support staff. A restricted policy covers sensitive HR, executive, regulatory, or board work with a named core team.
- Ethical walls and investigations. These admit strict need-to-know users and groups only, with a designated member of the general counsel’s office on investigation policies.
- Deal rooms, outside parties, and contractors. Deal-room policies cover the transaction team and selected executives. External-collaboration policies pair an internal owner with a narrowly scoped external group, and contractor policies are time-bound with limited rights.
These are implementation patterns drawn from practice, and your own library should reflect how NetDocuments workspaces are built on one primary attribute in your repository, usually the matter.
How should WSM policy management be delegated?
WSM policy management should be delegated to a small number of trained business owners, typically three to five people from legal operations, records, risk, or practice management. Delegation keeps security close to the people who know each matter, and it keeps routine changes off the repository administrator’s desk.
- Separate authority. Policy managers apply and adjust approved policies. Creating new policies, changing controls, and cabinet or repository administration stay with a smaller central team.
- Named ownership. Every active policy needs a named business owner who approves membership changes and signs off on reviews.
- Change records. Write down who may request a change, who approves it, and how it is recorded.
Every policy change should leave a trail of request, approval, implementation, and validation.
What should you prepare before a WSM rollout?
A WSM rollout should start with a classification of every workspace and a cleanup of the groups that policies will depend on. Policy automation cannot fix inaccurate group membership, so a stale group applied through WSM simply spreads the error faster.
- Classify workspaces. Tag each workspace as standard, restricted, ethical wall, external collaboration, or temporary access. Most organizations find 5 to 10 percent fall outside standard.
- Clean up groups. Reconcile directory, identity provider, and NetDocuments group membership, and remove leavers before any policy is applied.
- Pilot representative workspaces. Apply policies to 10 to 20 workspaces covering each pattern for about two weeks before the wider rollout.
For a repository of a few thousand workspaces, classification, cleanup, and pilot together usually take four to six weeks.
How do you test WSM ethical walls before go-live?
WSM ethical walls are tested by proving both sides of the wall: that authorized users can do their work and that everyone else cannot find, search, open, download, share, or administer the content. Negative testing is the half teams skip, and it is the half a client or regulator will ask about.
Positive scenarios confirm each role on the policy can open, edit, and share at exactly the level granted. Negative scenarios log in as a user outside the wall and try every route in, including search results, recent documents, email filing, and shared links. A pilot usually needs 30 to 50 scenarios across all policy types.
Run the same scripts after every policy change. Skipping role-based security testing is a common cause of chaotic go-lives. Access rules carry extra weight because stolen logins are common, and an analysis of 12,195 confirmed breaches found credential abuse was the most common way attackers got in, at 22 percent.
How should WSM access be reviewed and measured after go-live?
WSM access should be reviewed on a fixed schedule using workspace security reports, with restricted and ethical-wall policies reviewed quarterly and standard policies every six months. Reports should also run at matter closure, role changes, departures, and any suspected conflict.
- Coverage targets. Aim for 100 percent of restricted workspaces governed by an approved policy and 100 percent of policies with a named owner.
- Access findings. Target zero confirmed unauthorized-access findings and zero high-privilege assignments without a documented justification.
- Deprovisioning. Remove departed users and temporary members within one business day, and at matter close archive the access evidence and retire policies that are no longer needed.
Save each periodic report. When a client audit arrives, a year of stored reports answers most questions in an afternoon.
Conclusion
NetDocuments Workspace Security Manager gives you a way to secure sensitive matters consistently, however many workspaces you run. Its value comes from the program around it: a short policy library, clean groups, named owners, delegated management with clear limits, and testing that proves who is kept out as well as who is let in. Built that way, ethical walls stop depending on one administrator’s memory and become something you can report on with confidence.
How Basla can help
Basla provides certified delivery team members for NetDocuments implementation, covering legal technology consulting, security design, NetDocuments Workspace Security Manager policy libraries, group cleanup, positive and negative access testing, policy documentation, and post-go-live support. The team works with your legal operations, records, and IT staff to classify workspaces, pilot policies, and write the review procedures your policy owners will follow.
Frequently asked questions
What is NetDocuments Workspace Security Manager?
NetDocuments Workspace Security Manager is a capability for creating standardized security policies and applying them to workspaces. It supports ethical walls, need-to-know access, delegated policy management, and workspace security reporting.
What does a WSM policy contain?
A WSM policy contains two required elements: the users or groups allowed into the workspace with their assigned permissions, and a configured set of controls. Once applied, the policy governs access to all content in that workspace.
Is WSM included in every NetDocuments subscription?
WSM availability depends on your NetDocuments subscription and commercial agreement. It sits in the Security Center alongside other governance capabilities, so confirm licensing with your account team before planning around it.
How many WSM policies should an organization have?
Most organizations need five to eight standard WSM policies covering routine, restricted, ethical-wall, investigation, deal-room, external, and contractor workspaces. One-off policies should be kept for matters with unique confidentiality requirements.
How is WSM different from profile-based security?
WSM applies managed, reportable policies at the workspace level, while profile-based security restricts access through document metadata such as client or matter. The two can be used together in the same repository.
How often should WSM access be reviewed?
WSM access for restricted and ethical-wall workspaces should be reviewed at least quarterly, and standard policies every six months. Additional reviews should run at matter closure, departures, and role changes.
*This article is provided for general information only and does not constitute legal advice. Basla Solutions provides legal technology implementation and support services and does not practice law.*