When it comes to securing corporate information, many companies are clueless about which content needs protection, and most do not have a handle on the potential costs of not protecting it, according to a survey by AIIM-The ECM Association.
Asked what primarily drives their content security initiatives, survey respondents cited general risk avoidance as the top reason, followed by regulatory compliance, corporate policies as well as e-discovery and litigation concerns. But when asked what percentage of their organisation's content requires specific controls to ensure their validity and security, 28% said they did not know.
More than 40%of respondents said that they had no idea whether any content had been inappropriately accessed within the past two years. 41% said they did not know whether any content had been inappropriately updated or deleted.
"There's almost this reluctance to spend much time and money on [content security] because there's a naive hope that if we never get caught we don't have to worry about it," says Carl Frappaolo, vice president of AIIM Market Intelligence and an author of the report.
AIIM is a professional association that provides market research and education about enterprise content management technologies and practices. Survey respondents included both association members and the general public. The questionnaire, administered online, was designed to provide a general snapshot of corporate knowledge and attitudes about content security issues.
Respondents also reported that making a business case for content security projects is challenging. Though few said they required a formal ROI study to implement content security initiatives, 75% of those who did project an ROI did not achieve an acceptable return.
Frappaolo says that's because most companies have a hard time calculating their risks. An exception, he says, is a financial services company with which he worked. "One day an executive happened to notice there was an expense exceeding a million a year for temp services. [The company] was hiring temps to help with e-discovery," Frappaolo recalls. "That's when they decided they could cost-justify bringing in some software. Not everyone is that fortunate to see something like that."