EDMS Feature Checklist – Data Security

Data Security

Functions & purpose they serve	Is this an important feature for your use case?
Role-based rights and access Can you enable/disable functions for specific users based on their role within the organization? Example: For the purpose of security, some users may have the rights to perform scanning and bulk data importing, but do not have the ability to download and print. A user who is not an administrator for his/her department will not be able to edit file descriptions or move files around the different folders of the department. Only the selected admin has the right to import and export a huge number of files into the EDMS within a specified time-frame. This can be a security measure to prevent the malicious bulk download of sensitive data at any one time. It also prevents instances of human error (accidental deletion) or misuse where staff import a large volume of unnecessary data into the EDMS taking up space and processing power.
Is there role-based access control to documents and folders? Users are granted access to certain sets of folders based on the role they play in the company as well as their seniority. E.g. A HR director will have full access to all HR files and folders but will not be able to access files and folders belonging to the finance department. In the event that this HR director is transferred to the marketing department, he/she will now have access only to files and folders of the marketing department. Access is controlled and pre-set by the role played.
Inheritance access rights Does the EDMS support inherit access rights? Take for example the HR department. If an executive creates a personnel folder within the Hr department, the Manager and Director of the HR department will have automatic access to the file/folder.
Can exceptions be created to alter inheritance access rights? This is to allow flexibility in how access rights are structured.
Administrative rights of department heads What level of administrative rights does each department head have? Do you need administrative and security control of the different departments delegated to the department heads; or is a centrally controlled setup sufficient?
Single Sign-in Can we set the system to allow one sign-on at any time? I.e. the system will not allow the same user ID to log-in and access the system at the same time.
Automatic log out after a pre-set period of inactivity Can we set the system to automatically log users out after a pre-set period of inactivity? This is a security measure to prevent unauthorised access to the system where the authorised user may have already left his/her desk without logging out.
Passwords Can we set mandatory password requirements? Specifically: Length Complexity and Duration
Data security and compliance with regulatory policies Is the security of the data at rest and data in transmission in compliance with your organization’s policy as well as the regulatory policy? You may need to check with your IT department if there are specific requirements for encryption of data in transit and at rest as well as the level of encryption needed.
Does the system support SSL for the secure transmission of files and folders? E.g. information transfer between the web browser and the cloud server; or information transfer between the mobile app client and the cloud server.
Auditing Is the level of audit tracking sufficient to satisfy the company’s policy as well as the regulatory policy the company and its offices are operating in? Audit tracking involves tracking of each and individual file. E.g. When it was created, Who created it. When it was viewed Who viewed it When it was modified Who modified it.
Can we require users to indicate the reason for downloading, overwriting, deletion, moving and printing of files for the purpose of audit trail?
Digital approval/ signature Is the system able to support digital approvals? I.e. are superiors able to digitally approve a request within the system.
Secure deletion of files Do you require secure deletion? When a file is deleted, is the sector overwritten by data? A popular standard is the DoD 5022.22 M-compatible deletion protocols. It is key that the standards used satisfies the company and regulatory requirements.
There should be a deletion holding area to guard against accidental or malicious deletion of data. Is the control of this deletion folder intuitive for the administrator to use?
Forced watermark function to indicate the origin of printed/exported data Is there a forced watermark function that can be turned on/off depending on the role and level of access? The forced watermark function can include the details of who printed the document and other meta details such as date, time and originating folder.
Security of web services and API Does the system support API access? What are the steps and protocol in place to ensure that it is as secure as accessing through the official client or web portal provided by the system?