Document and Records Management System Security

A document or records management system concentrates an organisation's contracts, case files, correspondence and evidence in one place, so a single over-privileged account or an unmonitored export can take all of it at once. Document management systems (DMS) and electronic records management systems (ERMS) are used by law firms, insurers, public bodies, healthcare providers and any regulated business that must prove what it held and when. This guide covers how to secure the platform itself: access by matter, case or project; protecting records from alteration and early deletion with retention locks; separating records administration from IT administration; controlling bulk export and integrations; and the logs that show it is working. It is written for security architects, records managers and the IT teams who run these platforms, whether on premises or in the cloud.

Key takeaways

Access should follow the matter, not the department. Default to "no access" across matters, cases or projects, with membership granted by the owner and walls enforced by the system.
Retention locks protect against your own administrators. Immutable record declarations and locked retention policies stop deletion by a compromised or malicious admin as well as by users.
Bulk export is the breach. Most large DMS losses are a valid account downloading far more than its owner ever needs, so export privileges and volume alerts matter more than perimeter controls.
Records administration is a separate privilege. The people who can change retention, release holds or dispose of records should not be the same people who run servers and backups.
Integrations and service accounts see everything. Scanning, email filing, search indexing, AI assistants and eDiscovery connectors usually run with read-all rights and need the same scrutiny as administrators.

What a DMS or ERMS holds and how it differs

A DMS manages working documents: versions, check-in and check-out, profiles (metadata such as client, matter, document type) and workspaces. An ERMS manages records: items declared as evidence of a business activity, classified against a file plan, kept for a set retention period and then disposed of with proof. Many platforms do both. ISO 15489-1:2016, the international standard for records management concepts and principles (confirmed in 2021), covers records, their metadata and records systems in any format, and the policies, responsibilities and controls around them. The US National Archives' Universal Electronic Records Management Requirements (Version 3, June 2023) group system requirements into capture, maintenance and use, disposal, transfer, metadata and reporting.

Security property	Document management focus	Records management focus
Confidentiality	Matter or workspace access, ethical walls, external sharing	Access to closed and archived records, transfer to archives
Integrity	Version history, check-out control	Declared records cannot be edited or deleted; metadata preserved
Availability and retention	Backup and recovery of working files	Kept for the full retention period, held when litigation requires it
Accountability	Who opened, changed or shared a document	Who changed retention, released a hold or disposed of records, with proof

Matter, case and project-level access

Professional services, insurers and public bodies organise documents by matter, claim or case. Access control should do the same.

Default private workspaces: new matters or cases are visible only to the assigned team. Organisation-wide "everyone can read" defaults are the most common DMS weakness found in reviews.
Owner-granted membership: the matter owner or case lead grants access, with a request record. Access requests from outside the team go to the owner, not to IT.
Ethical walls and information barriers: where conflicts, privilege or regulation require separation, enforce the wall in the DMS and in connected email and collaboration tools, and log every attempt to cross it. For law-firm specifics see the Law Firm Identity and Data Security Guide.
Security on the profile, not the folder: base access on structured metadata (client, matter, classification), so documents filed into the wrong folder do not inherit the wrong permissions.
Closed matters: reduce access when a matter closes to a small records team, so former team members cannot browse old files.
External parties: clients, counterparties and experts should use a portal or secure share with named accounts and expiry dates, not guest access to the internal DMS. See the Third-Party Access Guide.

Access model	Strength	Weakness	Fits
Open by default, restricted by exception	Easy collaboration and knowledge reuse	Everyone can read nearly everything; insider and stolen-account exposure is total	Rarely appropriate for client or personal data
Matter or case team only	Strong need-to-know	Requires owner engagement and fast joiner and mover handling	Law, insurance claims, HR and case management
Attribute-based on profile metadata	Scales; follows the document	Depends on accurate metadata at filing	Large estates with mature classification
Walls layered on any model	Enforces conflicts and regulatory separation	Must cover every connected tool, not only the DMS	Conflicts, M&A, research and trading separation

Retention locks and record immutability

Records must survive deletion attempts by users, ransomware operators and administrators. Modern platforms provide locks at several levels; use the strongest one the obligation justifies.

Declared records: Microsoft Purview's retention labels can mark an item as a record, which blocks deletion and, when locked, editing. A regulatory record label is stricter: once applied, nobody, including a global administrator, can remove it, and the retention period can only be extended.
Locked retention policies: Purview's Preservation Lock, applied with Set-RetentionCompliancePolicy -RestrictiveRetention $true, prevents anyone, including a global administrator, from turning off, deleting or weakening a retention policy; locations can be added and retention extended but never reduced. Microsoft describes it as a safeguard against rogue administrators.
Storage-level WORM: for archives on object storage, Amazon S3 Object Lock in compliance mode prevents any user, including the root user, from overwriting or deleting a protected object version or shortening its retention. Governance mode can be bypassed only by users with s3:BypassGovernanceRetention, which makes it suitable for testing before compliance mode. AWS states Object Lock has been assessed by Cohasset Associates for SEC 17a-4, CFTC and FINRA environments.
Legal holds: holds must override disposal schedules. In S3 a legal hold is independent of the retention period and stays until a user with s3:PutObjectLegalHold removes it. See the eDiscovery and Legal Hold Guide.

Decision guidance: irreversible locks are a commitment. Lock only policies that implement a confirmed legal or regulatory retention period, and test with a non-locked or governance-mode equivalent first. Over-retention is also a risk: keeping personal data longer than needed conflicts with data protection storage limitation, and every extra year of records is extra breach exposure. See the Data Retention and Secure Deletion Guide.

Separating records administration from IT administration

Role	Should be able to	Should not be able to
Platform administrator (IT)	Patch, configure integrations, manage servers and storage	Read matter content by default, change retention, release holds, approve disposal
Records manager	Maintain the file plan, retention schedules, disposition reviews	Change authentication, add integrations, grant themselves matter access
Legal or compliance (holds)	Place and release legal holds	Dispose of records or alter retention
Security administrator	Manage access policies, walls and audit settings, review logs	Delete or alter audit logs
Matter or case owner	Grant and remove team access for their matter	Change retention or export the whole repository

Use dedicated administrative accounts with phishing-resistant MFA, just-in-time elevation where the platform supports it, and alerting on any change to retention, holds, audit settings or wall policies. See the Segregation of Duties Guide and the Privileged Access Management Guide.

Controlling bulk export and integrations

Valid accounts downloading at scale explain more DMS losses than exploits. In the Scania Insurance Portal Breach 2025, a legitimate external user's login, believed captured by infostealer malware, was used to download claim documents from a portal run by an IT partner.

Export as a privilege: separate "open and read" from "download", "export folder or workspace", "email out" and "sync offline". Give bulk export to a small role, ideally with approval.
Rate and volume limits: where the platform supports it, cap documents per hour per user and per API client, and alert above the cap.
Offline sync and desktop clients: offline copies on laptops defeat retention and access changes. Restrict offline sync to managed, encrypted devices.
Integration accounts: email filing, scanning and capture, search indexing, eDiscovery, backup and AI assistant connectors often hold repository-wide read access. Give each its own identity and scope, keep secrets in a vault, and monitor its volume against its normal pattern. See the Service Account Security Guide.
AI assistants and search: an assistant or enterprise search index that ignores matter permissions will surface documents to the wrong people. Confirm the connector enforces item-level permissions and walls before enabling it. See the Enterprise AI Copilot Security Guide.
On-premises servers: internet-facing DMS and collaboration servers are actively exploited. CISA's Known Exploited Vulnerabilities catalogue lists many Microsoft SharePoint flaws, including CVE-2025-53770, and the ToolShell SharePoint Exploitation 2025 showed that stolen machine keys kept attackers in after patching, so rotate keys and secrets as part of remediation. See the SharePoint Server Security Guide.

Implementation roadmap

Baseline (weeks 1 to 4): export the current permission model, list every admin, records and integration account, identify workspaces open to "everyone", and check patch and exposure status of on-premises servers.
Quick wins (weeks 2 to 8): enforce SSO and MFA, remove "everyone" read on client and personal data, disable stale external accounts, and turn on full audit logging with forwarding to the SIEM.
Access model (months 2 to 6): move to matter or case-team access, pilot with two practice groups or departments, and keep the previous permission export for rollback if teams are blocked from work they need.
Retention and records (months 3 to 9): map the file plan to retention labels or schedules, test in non-locked mode, then apply record declarations and locks only where obligations are confirmed by legal and records owners.
Export and integration controls (months 4 to 9): split export privileges, scope integration accounts, set volume alerts, restrict offline sync.
Operate (ongoing): quarterly access recertification by matter owners, annual review of retention schedules, and disposition with proof.

Small organisations on a cloud DMS can get most of the value from SSO with MFA, private-by-default workspaces, record labels on final documents and alerts on bulk downloads. Large and regulated organisations need formal role separation, locked retention for regulated records, wall enforcement across connected tools and evidence for auditors.

Detection and measurement

Collection from document repositories maps to MITRE ATT&CK T1213 Data from Information Repositories (T1213.002 for SharePoint), often followed by automated collection (T1119) and exfiltration to cloud storage (T1567.002); destructive attacks map to T1485 Data Destruction. Log and alert on:

Volume anomalies: downloads or exports per user or API client above their 90-day baseline, especially across many matters.
Wall and access events: denied attempts to open walled or restricted matters, and self-granted access by administrators.
Retention and hold changes: any change to retention policies, labels, holds or disposition outside an approved request.
Audit configuration changes: disabling or reducing audit logging, which should page the security team.
Leaver activity: heavy downloading by users with a known leaving date. See the Insider Data Theft Guide.

Metric	Target (NHI Mgmt Group recommendation)
Workspaces with client or personal data readable by "everyone"	Zero
Matters with access recertified by owner in the last quarter	Above 95%
Accounts holding both platform admin and records or hold rights	Zero, or documented exceptions
Integration accounts with repository-wide read and no owner	Zero
Bulk export alerts triaged within one business day	100%
Records past retention awaiting disposition	Falling trend

Framework mapping

Control area	NIST CSF 2.0	NIST SP 800-53 Rev. 5	ATT&CK
Matter and case access, walls	PR.AA-05	AC-3, AC-6	T1078, T1213
Separation of records and IT administration	PR.AA-05	AC-5	n/a
Retention, records and disposal	ID.AM-07	SI-12, MP-6	T1485
Encryption and storage protection	PR.DS-01	SC-28	n/a
Bulk export and integration flows	PR.DS-02	AC-4	T1119, T1567.002
Audit logging and protection of logs	PR.PS-04, DE.CM-03	AU-2, AU-9, AU-11	n/a
Backup and recovery	PR.DS-11	CP-9	T1485

Common failure patterns

Open-by-default repository: every user can search and read every matter, so one phished account exposes the whole client base.
Walls only in the DMS: the ethical wall blocks the DMS but not the connected email archive, search index or AI assistant.
Admin can do everything: the platform administrator can also change retention and dispose of records, so a single compromised admin can destroy evidence.
External user accounts never expire: portal accounts for clients and partners outlive the engagement, and a stolen login downloads documents unnoticed, as in the Scania portal breach.
Locks applied without legal sign-off: an irreversible lock is set on the wrong scope or period, creating over-retention that cannot be undone.
Patched but not rotated: on-premises servers are patched after exploitation but keys and service account secrets are left unchanged.

Practitioner checklist

Remove "everyone" read from workspaces holding client, case or personal data.
Grant access by matter or case team, approved by the owner, and recertify quarterly.
Enforce ethical walls in the DMS and in every connected email, search and AI tool.
Separate platform administration, records management, holds and security administration.
Declare final records and apply locked retention only where a confirmed obligation exists, after testing unlocked.
Make bulk export, offline sync and API access distinct privileges with volume alerts.
Give every integration its own scoped identity with an owner and vaulted secret.
Forward full audit logs to the SIEM and alert on retention, hold, wall and audit setting changes.
Patch internet-facing DMS servers promptly and rotate keys and secrets after any compromise.

Document and Records Management System Security Guide: Matter-Level Access, Retention Locks and Bulk Export