Choosing internal communications tools: access and workflow

What to take away

Internal communications tools cover many areas. These include:

Examples in those categories include Microsoft Teams, Slack and Google Chat for collaboration, Microsoft Outlook and Google Workspace for email, and Zoom, Microsoft Teams and Google Meet for virtual meetings. Intranets, employee apps and internal communication platforms include SharePoint, Simpplr, LumApps, Staffbase, Firstup, Workvivo and Poppulo, and surveys run through tools such as Qualtrics, SurveyMonkey and Microsoft Forms. Treat each name as an example of its category, not as an endorsement, and still test it against your own scenarios.

Build a controlled comparison

NIST Special Publication 800-46 Revision 2 gives telework and remote-access security guidance for enterprise technologies, including organization-issued and personal devices. Use its threat-based approach to bring security and privacy specialists into requirements. The publication approves no internal communication product.

Where the data goes

Ask where employee profiles, private messages, attachments, and recordings are processed. Ask where transcripts, survey responses, and analytics are processed. Ask which vendor staff can reach them, and under what contract terms.

Employee data is regulated by name. For employees in the EU, the General Data Protection Regulation (GDPR) applies, enforced by national data protection authorities. The US has no single federal employee-privacy statute; state laws such as the California Consumer Privacy Act and the California Privacy Rights Act cover employee data, with the California Privacy Protection Agency as the state regulator. Name the law that applies to each workforce in your requirements document.

Map administrator access inside your own organization, including agencies, contractors and temporary administrators. Test multifactor authentication, least-privilege roles, account lifecycle, and logs.
Test backups, incident notice, deletion, and export.

Section508.gov's accessible meetings guide lists keyboard use, screen-reader compatibility, captions, accessible documents, alternative ways to participate and accommodation requests. Its legal requirements address federal contexts, but the scenarios help any buyer test whether a meeting is usable by the intended workforce. The standard behind those requirements is the Web Content Accessibility Guidelines (WCAG), which the revised Section 508 standards incorporate at WCAG 2.0 Level AA; many buyers now test against WCAG 2.1 Level AA as well.

Run one real workflow

Publish a policy change end to end. Start with a restricted draft, approval, targeted notice and an accessible document. Then handle these steps:

Watch employee effort, not only administrator controls. A correction that takes an administrator four clicks can take a deskless employee a shift to notice.

Retention has named authorities. In the US, the Fair Labor Standards Act and Internal Revenue Service rules govern payroll and employment-tax records, while the Equal Employment Opportunity Commission and the Occupational Safety and Health Administration set recordkeeping rules for personnel and workplace-safety files. Chat, meeting and survey records are not covered by a single US statute; they follow your own published retention schedule, so write that schedule down, name its owner, and apply it to every tool you shortlist.

Some of these products publish per-seat list prices and others quote by edition and module, and storage, integration, support and migration are often separate lines. Ask every finalist for the same three-year written quote and compare the totals line by line rather than accepting a headline seat price.

Test the operating burden

The GOV.UK technology selection guidance recommends adaptable choices, data control, security review and ownership-cost analysis. Apply those public-service questions when assessing internal communications tools; they are not product endorsements.

The GOV.UK open standards guidance links open standards with interoperability and reduced supplier dependence. Test whether your data and definitions can move to another system. Keep that page's UK public-service context in view when you borrow its tests.

For US public-sector buyers, the equivalent checkpoints sit in the Federal Acquisition Regulation (FAR) and in existing NIST guidance; private-sector buyers can apply the same questions without the federal paperwork.

Keep the evidence record beside the decision, so a reviewer can reproduce the reasoning without relying on memory. Set the next review date and name the change that would trigger an earlier check.

Common questions

These are the questions buyers raise most often once the scenarios above are run.

What is the best internal communication tool?

The best fit serves the defined audience and workflow. It also meets these requirements:

Does a small company need an employee app?

Not necessarily. Existing email, a controlled source page, manager conversations and tested alert routes may cover the required jobs. Buy the app only when those routes fail a scenario you actually run.

How long should a tool trial run?

Long enough to cover routine and failure scenarios across the full lifecycle: correction, accessibility, lost access, outage, retention and export. A fortnight of demos tests none of those.

Who should own the tool decision?

Name one accountable owner, usually in internal communications, with security, privacy, IT and records as reviewers. Without that name, every failure lands on whoever answers the support ticket.