Security Self-Assessment

Here are Some Questions to Consider About Your Company’s Security:

• Are you aware of state and federal privacy laws that relate to your business?
• Are you concerned about trade secrets or corporate espionage?
• Who in your office is responsible for maintaining compliance?
• Who is trained for an information breach?
• Have your employees received proper training on privacy legislation?

Every business, no matter the industry, has rules and regulations in place that affect how your company stores and discards its data. Neglecting to follow privacy laws can lead to large fines and other penalties that could be detrimental to your business. It’s important to have someone in charge who can enforce these directives, carry out proper procedures in the event of an information breach, and train employees in correct security practices.

What Does Your Company’s Shredding Policy Look Like?

• Does your office shred confidential documents?
• If documents are shredded, how is destroyed material disposed?
• What type of content are you currently shredding?
• Does your organization have a policy in place to address the storage and destruction of confidential data? If so:
  -Is it a written policy?
  -Who is accountable for enforcing it?
  -Is there a procedure for storage devices like discs, drives, etc?
  -Who is responsible for shredding documents?
  -Where are your documents being shredded?

One of the easiest and secure ways to abide by privacy laws is to shred all confidential documents. Unfortunately, an in-office shredder can only destroy paper, leaving tapes, X-rays, disks, hard drives and much more vulnerable to a breach. A professional paper shredding company can ensure security by properly disposing of these mediums. It is also a more efficient, affordable, and environmentally-friendly way to destroy shredded materials. Your business can benefit greatly from a detailed data destruction policy.

How Does Your Company Handle Confidential Data?

• Do you separate confidential and non-confidential information?
• Who decides what is and is not confidential?
• Are documents saved in open, unsecured areas of the office?
• Do visitors walk through the office unescorted?
• Is there a documented chain of custody (Signed Certificate of Destruction) to establish process patterns and for audit purposes?
• Would you worry if any trash or recycling went public?

An annual look at your business policies and procedures in handling confidential data can bring to light vulnerabilities in your system. You can prevent security risks to your business by shredding all information, confidential or not. Your company’s personal data is at stake when you store documents in open areas, leave visitors unmonitored, and discard documents via trash or standard recycling workflows. One stray paper could affect the brand, reputation, and image of your business.

Is There Room for Errors in Your Company’s Security?

• Do any employees work remotely?
• Are documents stored offsite?
• Does your organization archive using imaging, scanning, etc?
• Do you have signage regarding information-security?
• Do all departments have access to containers?

There are other factors that can pierce the weak areas of your company’s security— employees who work offsite, storing documents in a secondary location, etc. Making just a few small changes in the workplace can protect your information. Scanning documents, displaying information-security instructions, and giving every department access to a shredding container can make all the difference.

What Does the Relationship with Your Current Shredding Contractor Look Like?

• Do you do semi-annual process reviews with your shredding contractor to ensure your procedures address current risk levels?
• Is your shredding contractor certified by ISO for quality and satisfaction standards, and by NAID AAA for compliance?
• Does your current provider offer training for document security risks?
• Can you demonstrate that you have taken reasonable actions to protect private information?
• On a scale of 1 to 10, how comfortable are you that your information-security processes are compliant and sufficient?