Security features to look for when choosing a documentmanagement system

How secure will my documents be?

That’s a good starting question when you begin to look at and evaluate a document management system.

Security breaches get a lot of attention and may sound commonplace, but you and your business should not accept them as a given. You can do a lot to prevent them – starting with how you secure and protect your documents, information, and data.

In this article, we’ll look at seven security features you should look for in a document management system. These security features play key roles in keeping your information secured – both from potential inside breaches (accidental or not) and from outside attack.

We will also share questions to ask when evaluating a system.

What is a document management system?

Starting at the beginning, we might ask, what defines a document management system? We provide an in-depth answer in our article, “What is a document management system?”

For the quick answer…although any system or process responsible for the management of documents can be defined as a document management system, the term itself has come to commonly refer to digital platforms that store and archive electronic documents.

You may also see variation in types of document management systems. Document security often varies from one system to another, and as a business, you want to make sure to find the one that ensures your documents are as secured as can be.

How to evaluate your document security

The security of your documents matters. Data loss and litigation are headaches no one wants, especially with the potential fines and loss of reputation that can frankly ruin a business.

To evaluate the current security of your documents and information, you can ask yourself these questions about how your organization handles documents:

• How do we protect against accidental or deliberate internal security breaches?

• Are we protected from hacking threats?

• How would we access and recover our information in the case of a natural disaster?

• Could we be accused of data mismanagement? Could we demonstrate proper document and data handling?

• Is there a clear retention policy and practice in place for legally sensitive information?

• Are we at risk of any financial penalties?

You can dig deeper into how documents are handled by looking at how employees engage and work with documents. Here are a few questions to get you started:

• Can employees get the documents they need, immediately when they need it?

• Do employees always know whether they are looking at the most current document?

• Are employees trained in proper document handling, especially against social hacking and social engineering attacks?

Once you have the answers to these questions, and any others you identify and ask, you’ll know which document security features you most need.

7 key security features to look for in a document management system

These questions address security features of a document management system. If you are looking at cloud document management – where the provider hosts your system, you may want to ask specific questions about their data center security.

Read more about cloud document management in our article, "An introduction to cloud document management."

You can find questions to ask about a potential partner’s data center in our article, “Is your cloud vendor secure?” 

1 - Data encryption

A document management system’s security begins with how it encrypts data.

But it isn’t only the system itself that you should evaluate. You also want to understand data security between the different systems, including the PCs, tablets, and other devices which may connect to the system.

Look for 256-bit encryption (AES). This is military-grade encryption and the standard for U.S. government classified documents at the highest level. It may sound excessive, but it’s not. Most business systems use at least this standard.

Traffic between systems and devices should also feature HTTPS encryption. HTTPS has the added security layer of TLS/SSL. Standard HTTP communication lacks this security protocol and makes it easy for hackers to intercept critical data like passwords and financial information, especially when employees might be accessing the system from remote locations.

2 - Access rights management

Controlling who can access documents is essential. Your documents should only be accessible after a user enters their username and password. Assigning users to the system limits the risk of unauthorized access. Specific access rights can be assigned so users only see the documents relevant to them. 

You can also define different levels of document engagement. Some users may be view-only while others may have full edit rights. Most systems will allow you to define access at a group level, but for the greatest security, look for systems that allow for access rights definition at the individual level too.

Ideally, you want to be able to restrict access even on a document’s index data (meta-data), the data points that describe a document’s content and purpose.

3 - Redundancy

What will happen to your data and documents if a failure occurs somewhere?

Security often conjures images of protecting against attack or unwarranted access, however, protecting against technology failure is vital. If a system fails (for whatever reason), you need to know you can restore your data and ensure continuity.

Regardless of whether you choose cloud document management or an on-premises implementation, you should have a minimum of two levels of storage redundancy. Plus, you should add a third layer of off-site, preferably at a geo-graphically distant location, to protect against natural disasters.

This is one of the benefits of cloud document management. Aside from the absence of needing onsite infrastructure and doing your own backups, the data centers that host these systems already have these redundancies in place.

One item to consider: data sovereignty. Whether you choose cloud document management or third-party data center backup, you want to know where your data will be stored. Cloud providers are supposed to ensure that all data and backups stay within the nation’s borders that legally protects you and your data.

4 - Virus protection

Malware embedded in a document can wreak havoc on systems and local devices. You need to ensure that your system actively protects against these threats, to protect the platform and user devices.