Sense of Security

An important element of the overall services provided by companies that store records and/or destroy documents is securing the records that are in their custody. If any records or documents are compromised or stolen, the reputation of the client and the information management company would be in jeopardy, as would the service provider’s longevity.

The type and complexity of the security measures that a company implements depends on the needs of their clients based on the security classifications of the records and documents that are being stored or destroyed. Sensitive financial records may require a more stringent and complex security strategy than other types of document. Client demands based on record classifications along with industry best practices and reasonable budget constraints will define the type, functionality and size of the security measures described herein.

Securing the facility that holds these records is a matter of controlling access, both to the facility itself and to the specific areas within the facility where the records are stored or the documents are destroyed. Both of these facets are best accomplished using a combination of physical security, detailed policies and procedures and informed personnel.

Physical security can restrict access to a facility using different methods depending on whose access is being restricted and when.

Locks and lighting are the first, and very important, steps in disallowing unwanted access to a facility from outside intruders after business hours. Other physical security measures in place become far less effective and in some cases completely worthless if the locks and exterior lighting to a facility are inadequate. Most companies are conscious of these measures and have them implemented.

In terms of electronic physical security measures, a burglar alarm system is most common and is, for the most part, effective and inexpensive. In general and non-comprehensive terms, magnetic sensors are installed on exterior (or interior in some cases) doors and windows, motion detectors or glass-break detectors are installed in specific areas of the facility, such as where records are stored or documents are destroyed, and keypads are installed to arm and disarm the system. If a door or window is opened or a motion detector or glass-break detector is activated when the system is armed, a siren is activated within the facility and, in most cases, a central dispatch station is notified and in turn notifies the local police department or facility personnel. A burglar alarm system should almost always be part of a company’s physical security program. However, a burglar alarm’s function is limited in that it does little to secure the facility during business hours, including securing it from otherwise authorized employees.

While this limitation makes a burglar alarm system no less important to a company’s overall physical security program, an electronic access control system is an important addition to that program and helps to combat that limitation. An electronic access control system can restrict access to the exterior of the facility and to interior areas during all hours of the day and night. In general and non-comprehensive terms, access readers are installed along with some type of electronic door hardware on the doors to areas that require restricted access. A company employee uses a credential, usually a card or key tag, to activate the reader, opening the door. Depending on the system design, there is either free exit or another credential check may be needed to exit the door.

Such systems can provide an audit trail of who entered or attempted to enter an area of the facility and at what time he or she did so. If any records or documents are compromised, this audit trail is invaluable. These systems are very effective and are moderately expensive at roughly $2,000 per door.

Controlling the entrance and exit of documents from a facility is more a function of policies, procedures and personnel rather than one of physical security. There must be specific and verified polices and procedures as to how documents enter and exit the facility and how they are accounted for. Proper supervision is required to verify personnel are following the policies and procedures.

While proper inventory tracking is accomplished primarily though policies, procedures and personnel security measures, physical security measures can help with this effort. RFID (radio frequency identification) systems can track individual cartons of documents within a facility. An RFID tag is placed on the carton and the location of the carton is tracked on a real-time basis using radio signals. If a carton goes from an authorized to an unauthorized area of the facility, any number of alerts can be activated.

The cartons can also be tracked using GPS technology. These systems are very effective, but also very expensive. Generally they would only be used for records and documents with the need for very high security.

Visual identification and verification is accomplished using a closed circuit television (CCTV) system. In general and non-comprehensive terms, cameras are placed in specific areas throughout the exterior and interior of the facility and are recorded by digital video recorders. A video monitor is installed so facility personnel can either view the camera images live or review the recorded images at a later time. The camera images can be stored for as much time as the company desires within the system’s specific design criteria.

These cameras can be used to identify and verify the movement and location of records and documents throughout the facility, including their entrance to and exit from the facility. The adage, "A picture is worth a thousand words," is in fact true, and cameras are an extremely effective physical security measure to deter record and document compromise as well as to determine what happened should a compromise occur. Unless personnel are watching the camera images live all the time, which is unlikely in light of costs and, in most cases, unnecessary, CCTV systems are not used to track inventory in real time.

All of these effective physical security measures cannot be used in a vacuum. They must interact with policies, procedures and personnel. This interaction can be very simple, like making sure someone verifies that the doors are locked and the lights are turned on. With a burglar alarm system, someone has to arm and disarm the system at a pre-set time or action event, such as "last person out." If the system is monitored by a central dispatch station, not only are personnel needed to monitor the system, but policies and procedures must be in place to determine exactly what should happen should the system generate an alarm.

If there is not a conscious interaction and integration of policies, procedures and personnel with a facility’s physical security measures, the measures will ultimately be useless.

It is important to note that while the adoption of policies and procedures is a very inexpensive security measure, personnel will always be the most expensive security measure. Personnel costs are a necessary component of a proper security program.

Policies and procedures should be in written form and not just verbal or "understood." The effectiveness of these documented policies and procedures should be evaluated on a regular basis.

If companies that store and/or destroy documents implement an integrated security plan that included physical measures, policies, procedures and vigilant personnel, the chance of record or document compromise is reduced. This, in turn, lessens the overall risk to a company and creates added value for its clients. n