Large stack of files

How law firms can protect their most sensitive paper records 

by Stephanie Kurtz
 With all the headlines about hackers and the theft of digital data, the security of paper records often is given short shrift.

But, paper left unsecured gives thieves an easy way to steal sensitive information. In fact, one in five security incidents1 of which law firm BakerHostetler advised in 2014 involved paper records.

That’s why it’s critical that information governance and document retention policies cover paper as well as electronic documents. For paper specifically, it’s important that the policy spells out how to track where documents are stored, for how long and how they are secured. 
person looking through file cabinet

Storing your paper documents

Do you know where all of your paper documents are located? Do you have security policies such as sign-in procedures at those facilities? Since cybersecurity is a huge focus, it’s easy to become lax about this area of information governance.

However, through my consulting experience, I’ve seen that in 20 percent of the instances when an attorney requests a box from a document storage facility, that box cannot be located. In an industry where access to the right information could make the difference in winning a matter, that’s an astounding statistic. A firm can get in big trouble if it can’t quickly produce all the documents demanded by a discovery motion.

In addition, matters often involve highly valuable and confidential information. For example, paper documents may include information on the intellectual property of a company. If paper schematics or drawings are in storage, it’s easy for someone to slip a folder into their briefcase and leave. Without a tracking process, how would you know? 

Preparing for the unknown

Another challenge with physical documents is that the possibility of destruction from natural disasters. Hard copy documents that require retention should always be scanned and back-file converted.


Hurricane Katrina was a great reminder of the importance of scanning documents for digital storage.

Hurricane Katrina was great reminder of the importance of scanning documents for digital storage. I learned this lesson first-hand while working for a company in New Orleans. Their digital information was backed up and available from a remote server within 48 hours after the hurricane. But, the paper contracts that were in file cabinets and boxes sat in four feet of water for over two weeks. Although it took thousands of hours to recreate those lost documents, I considered us lucky that we could reproduce them. Many organizations wouldn’t know where to start or even be able to identify what documents were lost.

To avoid these problems, make sure your document retention policy covers paper and is updated at least twice a year. The policy should clearly state what should be stored and where, the length of storage, security controls, disaster recovery plans and detailed destruction policies. In addition, make sure to include a process by which important paper documents are scanned, converted and digitally stored

Evaluating your paper retention processes 

Learn more about how the right partner can ensure you have a sound strategy and the proper tools to help protect your paper records from prying eyes.
Stephanie Kurtz
Stephanie Kurtz, Senior Manager, Advanced Services Strategy, Ricoh USA, Inc. is a technology innovator and leader with a sophisticated grasp on emerging and existing technology and its application to drive business performance improvement and strategy. Kurtz has over 25 years experience in Information Technology specializing in governance, risk, compliance and information security. She teaches technology, governance and risk courses at the graduate and under graduate level, and has CGEIT, CRISC, ECMp certifications. 
1  "The BakerHostetler Data Security Incident Response Report 2015." 2015.