--- title: A Security Risk Evaluation for Your Copiers description: Is copier security really a huge risk to my small business? The short answer? Yes, yes it is. image: https://www.ais-now.com/hubfs/Images/128_is-your-copier-secure.jpg --- [Skip to main content](https://www.ais-now.com/blog/a-security-risk-evaluation-for-your-copiers#maincontent) [«  View All Posts](https://www.ais-now.com/learning-center) # A Security Risk Evaluation for Your Copiers August 25th, 2017 | 8 min. read By [Gary Harouff](https://www.ais-now.com/blog/author/gary-harouff) ![128_is-your-copier-secure.jpg](https://www.ais-now.com/hubfs/Images/128_is-your-copier-secure.jpg) ![When was the last time you checked your security system? The locks on your doors? To see if your copier is secure?](https://www.ais-now.com/hs-fs/hubfs/Images/128_is-your-copier-secure.jpg?width=640&name=128_is-your-copier-secure.jpg "When was the last time you checked your security system? The locks on your doors? To see if your copier is secure?") It's no secret that we believe data and information security issues are important. Monique Phalen writes about security issues frequently from a network management perspective – [read them here](https://www.ais-now.com/blog/topic/security). I've written about copier security issues as well: - [Data Breaches and Your Digital Copier Hard Drive – What You Need to Do](https://www.ais-now.com/blog/data-breaches-and-your-digital-copier-hard-drive-what-you-need-to-do) - [Copier and Printer Security: Running From the Wolf](https://www.ais-now.com/blog/copier-and-printer-security-running-from-the-wolf) I'm sure some of you think some variation of “is it really that much of an issue”? Well, in a word, yes. Businesses run on information and documents. Your information needs to be keep secure. Even the government recognizes the security risks posed by digital copiers and printers. NIST's (National Institute of Standards and Technology) Computer Security Division provided guidance for Federal agences in NISTIR 8023 – Risk Management for Replication Devices. Once you wade through the stilted government writing, the recommendations are excellent. **How much risk does your printer and copier fleet pose to your business? Ask yourself these questions to find out.** The publication (which is free) includes a table with all of these questions and a number value for each that you can add up for a risk value. The link is included at the end of this post. Without further ado, the questions.   ## Planning/Secure Configuration - Is the device included within a system security plan with applicable controls implemented? - Does the device or its control software have any relevant security certificatons (e.g., Common Criteria)? - Does the vendor/manufacturer provide information on a secure configuration for the device? - If a secure configuration is available, has it been implemented on the device? ## Third Parties - Is the device leased by the organization? - If leased, does the lease agreement stipulate federal ownership of storage devices internal for the device? (Obviously, this is specific to Federal government.) - Is the device under a service contract? - If under a service contract, does the service contract stipulate that hard disk drives (HDD) and solid state/nonvolatile storage must be removed before the device can leave organizational control? - If under service contract, does the service contract stipulate that service technicians are not permitted to remove information stored within the device in any form? - If under service contract, does the service contract stipulate that only Original Equipment Manufacturer (OEM) or OEM-approved replacement parts should be used? - If not under service contract, are policies and procedures in place regarding media sanitization/removal of storage media requirements before the device or storage media can leave organizational control? ## Device Storage - Does the device have a hard disk drive (HDD) or solid state/nonvolatile storage media? - Is the device storage media easily physically accessible (i.e., no disassembly/tools needed)? - Can stored information be logically accessed / viewed (either at the device console or via web access)? - Is the device storage media encrypted using approved encryption standards (i.e., FIPS 140 validation or Common Criteria certification)? FIPS is Federal Information Processing Standards. There is a draft [FIPS 140-3](http://csrc.nist.gov/groups/ST/FIPS140_3/documents/FIPS_140-3%20Final_Draft_2007.pdf), though [FIPS 140-2](http://csrc.nist.gov/groups/STM/cmvp/standards.html#02) looks to be the final official document. I don't recommend reading either unless you're EXTREMELY interested in security standards. - Are the device configuration settings encrypted using approved encryption standards (i.e., FIPS 140 validation or Common Criteria certification)? - Does the device provide image overwrite capabilities? - If available, is image overwrite capability enabled? (N/A if not available) - If available, is immediate data overwrite capability enabled? - Does the device dump memory of replicated documents/images/objects on reboot? ## Network - Is the device connected to a network? - Is network communication encrypted using organization-approved network protocols (e.g., IPSec, SSL/TLS, WPA2)? - Is privileged access from a network encrypted using organization-approved standards (i.e., FIPS 140 validation or Common Criteria certification)? - Does the device prevent communications to unknown/unwanted addresses? (whitelist/blacklist) - Does the device prevent communications from unknown/unwanted addresses? (whitelist/blacklist) - Is the device protected by a firewall? - Does the device allow remote configuration? - Does the device allow call-home features? - Does the device allow remote monitoring? - Is the device connected via wireless (e.g., Bluetooth, 802.11)? - Is the wireless identifier broadcasting disabled? - Does the device allow external access by vendor technicians (for troubleshooting, updates, etc.)? - Does the device or vendor require external access? - Does the device have unused, open ports? - Can the device be patched/updated? - Must the device be patched by the manufacturer's technicians? - Can the print server be securely configured? - Can the print server be patched/updated? - Must the print server be patched/updated by manufacturer's technicians? - Is the device included in the organization's patch management program to keep software and firmware up-to-date? - Is the device scanned for vulnerabilities with the organizationally required frequency? ## Physical Security - Is physical access to the device controlled (e.g., in a locked room)? - Is physical access to internal device storage media controlled (e.g., using locks)? - Are materials (e.g., paper, ink, filament) secured within the device? - Does the device use sensitive or potentially hazardous materials or components (e.g., metal powder, laser, battery)? - Are the sensitive or potentially hazardous materials or components secured within the device? ## Access Control - Is logical access to the device storage controlled (e.g., using passwords, PINs, user accounts or roles, etc.)? - Is access to the device settings (configuration) controlled (e.g., using passwords, PINs, etc.)? - Have all vendor default passwords been changed? - If available, is privileged access (physical and logical) to the device limited to designated trained and knowledgeable staff? - Is in-person user verification required to complete a job (i.e., push/pull printing)? - Does the device provide functionality for controlling authentication and account management in accordance with organizational policy (e.g., password strength requirements, password changes, lockout procedures)? - Does the device allow identification and authentication synchronization with domain credentials? - Are logged-in users automatically logged off after a specified amount of time? ## Monitoring - Is usage of the device monitored? - Does the device notify (e.g., send email) administrators of errors or potential incidents (e.g., multiple account lockouts)? - Is audit/logging available and enabled on the device? - Does the device automatically detect and mitigate DOS attacks? - Does the device enforce time-out of queued jobs? - Is the device temperature monitored and controlled with automatic shutoff in case of overheating? I encourage you to think these questions through. If you're concerned about the information risk posed by your copiers, contact your copier dealer for more information. [![Think you won't be hacked just because you're a small business? Think again.](https://no-cache.hubspot.com/cta/default/2151016/f8f8c45f-d8a4-450c-8415-94050e70b18c.png)](https://cta-redirect.hubspot.com/cta/redirect/2151016/f8f8c45f-d8a4-450c-8415-94050e70b18c) [ Click here to read the NIST's (National Institute of Standards and Technology) Computer Security Division provided guidance for Federal agences in NISTIR 8023 – Risk Management for Replication Devices.](http://nvlpubs.nist.gov/nistpubs/ir/2015/NIST.IR.8023.pdf) [ Gary Harouff ](https://www.ais-now.com/blog/author/gary-harouff) As President and founder of AIS, I am passionate about growing our business and serving our customers. I'm proud that we are considered one of the fastest-growing companies in America. We have been named by Office Dealer magazine as the elite dealer of the year and, most recently, by ENX Magazine as an elite dealer for 2023. Our partnership with Kyocera is strong, and we have been an elite dealer for them. We're also an authorized dealer of Xerox in their Document Technology Partner Program. Before founding AIS, I was President of Toshiba Business Solutions. I enjoy staying active, both physically and professionally. Charitable endeavors include The Elizabeth Glaser Pediatric AIDS Foundation, Safe House, Christian Children’s Fund, and other faith-based charities. Connect: [mailto:gharouff@ais-now.com](mailto:gharouff@ais-now.com) Topics: [ Copiers & Printers ](https://www.ais-now.com/blog/topic/copiers-printers) Don't forget to share this post: ## Related Articles [### 2026 Review: Best Xerox Multifunction Copiers for Henderson NV Offices July 1st, 2026|10 min read ](https://www.ais-now.com/blog/2026-review-best-xerox-multifunction-copiers-for-henderson-nv-offices) [### Rolling Over a Copier Lease: Hidden Risks You Should Know May 27th, 2026|5 min read ](https://www.ais-now.com/blog/rolling-over-copier-lease-hidden-risks) [### Do I Have To Replace My Printers When Switching Vendors? May 27th, 2026|4 min read ](https://www.ais-now.com/blog/replace-printers-switching-vendors) [### Top Preventive Maintenance Tips for Office Printers May 4th, 2026|2 min read ](https://www.ais-now.com/blog/top-preventive-maintenance-tips-for-office-printers) [### Nearing The End of Your Copier Lease? Here's What to Consider April 30th, 2026|5 min read ](https://www.ais-now.com/blog/end-of-copier-lease-considerations) [### Cybersecurity And The Workplace: Keep Your Office Copiers and Printers Secure April 30th, 2026|5 min read ](https://www.ais-now.com/blog/cybersecurity-office-copiers-printers-secure) [### Office Copier Lease: What Are You Agreeing To? April 30th, 2026|5 min read ](https://www.ais-now.com/blog/office-copier-lease-what-are-you-agreeing-to) [### Is AIS The Best Vendor to Partner With For Your Copying Needs? April 29th, 2026|4 min read ](https://www.ais-now.com/blog/is-ais-best-vendor-partner-with-copying-needs) [### How Can a Kyocera Copier Dealer Help My Business Grow? April 29th, 2026|4 min read ](https://www.ais-now.com/blog/kyocera-copier-dealer-grow-business) [### Trimming Your Tech Budget: The Role of Regular Copier and Printer Care April 28th, 2026|4 min read ](https://www.ais-now.com/blog/trim-tech-budget-copier-maintenance) [### Office Copiers Unleashed: Exploring Advanced Features for Enhanced Productivity April 28th, 2026|6 min read ](https://www.ais-now.com/blog/office-copiers-advanced-features-enhance-productivity) [### How Much Does a Copier or Printer Service Contract Cost? April 28th, 2026|4 min read ](https://www.ais-now.com/blog/how-much-does-a-copier-or-printer-service-contract-cost) [### What Happens to Data Stored on Old Office Copiers? April 13th, 2026|5 min read ](https://www.ais-now.com/blog/what-happens-to-data-stored-on-old-office-copiers) [### How to Standardize Your Printer Fleet Across Locations April 13th, 2026|7 min read ](https://www.ais-now.com/blog/how-to-standardize-your-printer-fleet-across-locations) [### How to Secure Your Print Environment (Step-by-Step) March 24th, 2026|4 min read ](https://www.ais-now.com/blog/how-to-secure-your-print-environment-step-by-step) [### Subscription-Based Printing: Is It Worth It? March 24th, 2026|4 min read ](https://www.ais-now.com/blog/subscription-based-printing-is-it-worth-it) [### How to Build a Print Strategy That Scales With Your Business March 24th, 2026|4 min read ](https://www.ais-now.com/blog/how-to-build-print-strategy-that-scales-with-your-business) [### A3 vs A4 Copiers: Which Should Your Business Choose? March 19th, 2026|7 min read ](https://www.ais-now.com/blog/a3-vs-a4-copiers-which-should-business-choose) [### Why Does Your Copier Lease Payment Change Over Time? March 19th, 2026|6 min read ](https://www.ais-now.com/blog/why-does-copier-lease-payment-change-over-time) [### Best Ways to Reduce Printing Costs by 30%+ March 19th, 2026|7 min read ](https://www.ais-now.com/blog/best-ways-reduce-printing-costs-by-30) [### What Is Cost Per Print (CPP) and Why It Matters March 19th, 2026|7 min read ](https://www.ais-now.com/blog/what-is-cost-per-print-why-it-matters) [### Office Copier and Printer Security Risks Every Business Should Know February 25th, 2026|7 min read ](https://www.ais-now.com/blog/office-copier-printer-security-risks-every-business-should-know) [### How to Budget for Office Copier Upgrades February 25th, 2026|6 min read ](https://www.ais-now.com/blog/how-to-budget-office-copier-upgrades) [### How to Secure Multifunction Printers (MFPs) From Network Attacks February 25th, 2026|7 min read ](https://www.ais-now.com/blog/how-to-secure-multifunction-printers-from-network-attacks) [### Top Preventative Maintenance Tips for Office Printers February 24th, 2026|7 min read ](https://www.ais-now.com/blog/top-preventative-maintenance-tips-for-office-printers)