Copiers, Printers, and Scanners: What to Manage and Where the Data is Stored

In a recent discussion with some enterprise IT managers, we identified asset classes that need to be managed and ones whose cost to manage may outweigh the benefit (acceptable levels of risk). Monitors are typically on the bubble. Often, depending on where IT is aligned within the corporate structure, the expense to manage them will outweigh the benefit of doing so.

In this discussion, someone mentioned that they also do not manage copiers, as there are no data risks. This is incorrect! They do, however, perform a factory reset on printers. We were surprised to hear this and, together, immediately discussed the storage capabilities of all imaging assets. Printers, copiers, scanners, label and receipt printers, wide format printers, and other imaging assets that do or may store data must be part of the asset assessment process.

Most printers and copiers have a storage device that stores the operating system and captures the images that are printed, copied, or scanned. Many of the newer models have factory reset features that restore the assets back to an out-of-the-box state as it relates to settings. This will remove things like stored emails and job history, and even network information like IP addresses and other configuration settings. These data points are all considered protected data by many of the privacy laws and must be removed to help protect your corporate information.

In addition to this, many printers and copiers have SATA drives, NVME, M.2, or other SSD-type storage components, all of which store job history. Be sure to include these in your approved IT asset management (ITAM) processes to dispose of these assets like all others with stored data.

In many organizations, printers and copiers are managed through the finance or purchasing department and can be overlooked from the data security perspective, as they circumvent IT processes. You should also take special note of your assets that are part of a managed print service or leased assets. The leasing companies and MSPs generally do not take responsibility to wipe your data.

Your data, your responsibility!