Printer security comes down to five questions about a machine that’s easy to treat as furniture: what it keeps after a job, who can walk up to it, who can reach it over the network, what accounts it holds, and what happens to its drive when it leaves. Settle those five with your IT provider before the next lease or repair visit.
The Federal Trade Commission’s guide says the hard drive in a digital copier stores data about the documents it copies, prints, scans, faxes or emails. A joint advisory from the National Security Agency and the Cybersecurity and Infrastructure Security Agency lists printers among devices that commonly contain default credentials. A printer that nobody owns can hold copies of private documents. It can still use the login it came with. And it can leave the building with its drive inside.
Why Does Printer Security Matter in a Small Office?
The machine keeps data. The FTC’s guide describes a digital copier as a networked multifunction machine that copies, prints, scans, faxes and emails, and says it needs a hard drive to manage the jobs. That drive stores data about the documents. The guide says the data can be stolen by remote access, or after the drive is removed.
Those lines come from the FTC’s guide to digital copier data security, and copiers are what it addresses. A networked printer can raise the same questions. So ask your IT provider what your own machine does, and what its model keeps.
These are questions for your IT provider, and the time to ask is before a lease, a repair visit or a setup change.
What Does Your Printer Keep After a Job Is Done?
It can keep more than you’d expect. The FTC’s guide says deleting data or reformatting the hard drive doesn’t actually alter or remove the data. Overwriting is different. The guide says features like encryption and overwriting can come as standard equipment or optional add-on kits. So ask whether your printer has a drive, and whether those features are on.
Saved documents are a separate matter. The guide says some printers let you save a document, such as a personnel leave slip, and print it straight from the printer’s hard drive. It says those saved documents are not overwritten with the rest of the memory. So ask whether anyone has saved documents on a printer, and what those documents are.
For copiers that offer the feature, the guide’s advice is to securely overwrite the entire hard drive at least once a month. That’s a setting someone has to own. Three short questions cover it:
- Does this printer have a hard drive?
- Are encryption and overwriting turned on?
- Are any documents saved on the machine itself?
Who Can Walk Up and Collect the Pages?
Anyone standing at it may collect the pages, unless something stops them. The FTC’s guide says to use authentication at the device. That can mean a password, a card swipe or a biometric check at the machine itself. The idea is that whoever collects the pages proves who they are first.
The guide describes pull printing, sometimes called walk-up or release printing. If the manufacturer offers it, the printer holds the job until the user supplies proof of identity. Only then does the page come out. As a general rule, paper that sits in an output tray can be read by anyone walking past.
So picture the floor plan. Which printers sit in a hallway? Which sit in a waiting area or a shared room? Those are the ones to raise with your IT provider, and the question is whether a sign-in or release step is turned on for them.
Who Can Reach the Printer Over the Network?
That depends on the printer’s login and on its network connections. The joint advisory says printers, scanners and similar devices commonly contain default credentials that can be used for easy unauthorized access. The FTC’s guide is direct about it too: change the default network password. So the question is who holds the printer’s administrator login.
Those device lines come from the joint advisory from NSA and CISA on common network misconfigurations, which covers network settings in general. Printers appear there inside a longer list of devices. Neither that advisory nor the FTC’s guide is a rule for your business. Both are reference points for the conversation.
A printer is one device among several on an office network. The rest of the device list sits in a separate post about the other connected devices in your office.
The guide also notes that copiers may have more than one network connection, including wifi, and that those need securing like other wifi-capable devices. So ask three plain things. Who set this printer’s administrator login? Was it changed from the one the machine came with? And can a guest on the office wifi reach it?
What Accounts Does the Printer Hold?
A printer can hold a stored account. The joint advisory says printers and scanners may have accounts with wide access to the company network loaded, so staff can scan a document to a shared folder or email it. It says someone who gets in with default credentials can use those accounts to move from the device into the network.
As a general rule, a stored account should reach only the one folder or mailbox it needs. Nothing more. So ask your IT provider which account the scan function uses, and what that account can open.
Then ask a quieter question. Who would notice if that account’s password changed? Who would notice if the account got reused for something else? If the answer is nobody, that’s worth fixing before the next change to the office network.
What Happens to the Drive When the Printer Leaves?
That should be settled on paper. The FTC’s guide says to check that your lease or purchase agreement states your company will retain ownership of all hard drives at end-of-life. The other path it names is a written promise that the company providing the machine will overwrite the drives.
Removing the drive yourself is the part to be careful about. The guide cautions that the drive can include firmware the machine needs. Removing and destroying it without being able to replace that firmware can render the machine inoperable. The guide says it’s advisable to work with skilled technicians.
O&O Systems’ Hardware Procurement and Deployment page says its team tracks warranties and hardware lifecycles so you know when to repair, replace, or upgrade.
A printer may not be the only machine that leaves with data on it, and what to wipe when old equipment leaves covers the wider list.
What Should Your IT Provider Put in Writing?
Ask for answers you can read, keep and check later. A verbal yes in a hallway fades. An email or a shared document doesn’t. Written answers also give the next person a starting point, whether that’s a replacement office manager or a different IT provider. Six questions are enough:
- Does each printer have a hard drive, and are encryption and overwriting turned on?
- Who can collect pages at the machine, and how do they prove who they are?
- Who set the administrator login, and was the factory one changed?
- Which account does scanning use, and what can that account open?
- Who keeps the drive when the lease ends, and who has agreed to overwrite it?
- Who owns each printer on the business side?
The last one carries the rest. Name one person for each printer, even if the settings live with your IT provider, and keep the written answers with your equipment records. A machine with an owner gets asked about.
Frequently Asked Questions About Printer Security
Does a printer really store copies of what it prints?
The FTC’s guide says the hard drive in a digital copier stores data about the documents it copies, prints, scans, faxes or emails. Models differ, so the answer for your office is whatever your IT provider can confirm about your own machine. Ask whether it has a drive, and ask what that drive keeps.
Is deleting a file from the printer enough?
The guide says deleting data or reformatting the hard drive doesn’t actually alter or remove the data. Overwriting is the different step, and the guide treats it as a security feature that can come as standard equipment or an optional add-on kit. So ask your IT provider whether overwriting is available on your machine, and whether it’s switched on.
Do we need to change the printer’s default password?
The FTC’s guide says to change the default network password. The joint advisory says printers, scanners and similar devices commonly contain default credentials that can be used for easy unauthorized access. Neither page is a rule for your business, and both point the same way. Ask your IT provider to confirm that the factory login is gone, and that someone knows the one that replaced it.
Can we take the drive out ourselves before returning a leased printer?
Check the lease first, because the agreement may say who keeps the drive. Then leave the removal to someone qualified. The guide cautions that the drive can include firmware the machine needs, so removing and destroying it without being able to replace that firmware can render the machine inoperable, and it advises working with skilled technicians.
Who should own printer security in a small office?
As a general rule, that’s one named person on the business side. That person doesn’t configure anything. They know where each printer sits and who to ask when something changes. The settings belong with your IT provider. Pairing the two keeps the five questions from going unanswered between lease cycles.
Settle the Five Questions Before the Next Lease
The practical move is the same for any small office: settle the five questions, name an owner for each printer and keep the answers in writing. It can be one conversation with your IT provider and a short document you can find again.
If you want printer security settled for your own office, contact O&O Systems about the printers on your office network and start with who owns each one.
