≡ Menu

How to Manage and Share Highly Sensitive Documents

Regardless of the industry, every organization has a set of documents that they must keep confidential, even if they are to be shared and worked upon within a varying group of people. HIPAA, SOX and similar requirements of compliance for these might dictate that these types of documents must have tight access in a sort of lock down, while audit reports will also require showing which individuals have taken any action with a particular document, as well as when.

The more traditional methods of managing documents often provide these abilities within the firewall, but this does not take into consideration having documents shared outside of the company when necessary. However, there are secure ways to address this, providing solutions that provide a good workspace for document compliance.

There are a variety of programs and companies that address the challenges of sharing very highly sensitive documents outside of the standard enterprise. The issue that many companies face is having to have individuals outside of the organization collaborate with a company on a very important and sensitive document but while maintaining the security and the sanctity of the information within that document while also controlling the access and the distribution and maintaining the standards of the company policy.

There are some companies that can provide an online work space, which might include a repository for documents with access allowed at any time, and it can be installed within a company’s own data center. Some programs will not require client software, which means that folks who are not a part of the organization are also capable of being invited to use specific folders or documents within the dataroom.

To understand the idea of a dataroom better, consider it to be one deposit box inside of a bank vault in which a number of different authorized person is allowed to use the key. The administrator of the dataroom determines what rules and regulations all of the authorized people must follow as a part of the policy for accessing the documents. These rules can be granular, and they can be applied for each user or the group as a whole. These rules will determine who is allowed to print, disseminate, edit or download the content, giving the owner of the content total control of the content all the time.

Such an application will also allow the user to maintain very tight security controls to retain optimal security for such sensitive documents. Once a person attempts to access the datarom, they will use x.509v3 or SMS-PIN certificates as a form of authentication, in addition to his user identification and password. In addition to this level of security, all documents that are on such a server would also remain encrypted at all times, as well as be shielded from any IT operators.

For the documents that require the utmost security and confidentiality, there will also be a special dynamic watermark that will appear on the page in the event that a person attempts to take a screenshot of the screen or even attempts to take a photograph of it. Additionally, any actions that are taken with such documents will be captured and kept inside of an audit trail that is proven to be tamper proof, and such audit reports will then be able to be presented in a report to the content owner to validate whether or not the individuals are complying with the regulations of the industry or government or the policy of the company.

Complying with the policy of the company is always a critical part of the governance, risk and compliance — or GRC — programs. The best practices state that a company should always:

  • Rank the business processes and the appropriate documents according to the level of risk;
  • Come up with a proper strategy for compliance;
  • Set a number of policies for every document and all authorized users; and
  • Come up with an automated solution that can handle and secure all documents of highest sensitivity.

There are a number of programs that can provide a free trial of the secure work space for company documents. While some will not work out in the end, others can be very intuitive for both document administrators and authorized users alike.

Author Bio:- Stacy Gianakura writes for Brainloop, a company specializing in secure file sharing and online collaborative solutions.

{ 0 comments… add one }

Leave a Comment

This site uses Akismet to reduce spam. Learn how your comment data is processed.