Before deployment

  • Change the administrator password. Default credentials for every major manufacturer are published online. This is the single most exploited weakness on office devices.
  • Disable unused protocols and ports. Telnet, FTP, raw port 9100 and SNMPv1 are frequently enabled from the factory and rarely needed.
  • Enforce HTTPS for the embedded web server and install a certificate from your own authority rather than the self-signed default.
  • Enable storage encryption and data overwrite. Scanned and printed jobs are written to disk. Overwrite clears them after each job; encryption protects the drive if the machine leaves the building.
  • Put the device on the correct VLAN and restrict which subnets may reach it.

In daily use

  • Require authentication at the panel — card, PIN or directory login — before scanning or releasing print.
  • Use secure print release so documents only print when the person is standing at the device. This solves the confidential-page-on-the-tray problem completely and reduces waste.
  • Restrict scan destinations. Scan-to-email with an open address book is a straightforward data exfiltration path. Lock the address book and disable manual address entry if your risk profile calls for it.
  • Bind the address book to your directory rather than maintaining a separate list that keeps departed employees.
  • Keep firmware current. Manufacturers issue security firmware regularly. Devices under our service agreements are updated during preventative maintenance.

At decommissioning

This is the step most organizations miss. A copier leaving your building at the end of a lease still holds the drive it has been writing to for five years. Require a certified data sanitization — either a full drive overwrite performed and documented by the dealer, or physical removal and destruction of the drive.

Get it in writing, with the serial number on the certificate. If a leasing company insists the drive stays with the machine, negotiate drive removal into the agreement before you sign, not at the end.

What to ask a dealer

Does this model carry a Common Criteria (ISO 15408) evaluation? Is storage encryption standard or optional? What is the firmware update process and who performs it? What is your documented end-of-lease data sanitization procedure?

Every machine in our catalog lists its security features on the product page. Ask us for the sanitization procedure in writing before a lease ends.

Common questions

Do copiers store the documents they print and scan?

Most business multifunction printers write jobs to an internal drive as part of normal processing. Many keep them until overwritten. Enabling job overwrite and storage encryption addresses this, and both are standard on current business machines.

What should happen to a copier's hard drive at end of lease?

It should be sanitized to a documented standard or physically destroyed, with a certificate referencing the machine serial number. Agree the procedure when you sign the lease rather than when the truck arrives.