Wed, November 07, 2007 — CIO — When it comes to securing corporate information, many companies are clueless about which content needs protection, and most do not have a handle on the potential costs of not protecting it, according to a survey by AIIM—The ECM Association.

Among the 600 business people surveyed, 69 percent said their organizations had "no appreciation" for the costs of lost data. Yet they also cited legal concerns or regulatory mandates are among the top reasons content needs to be secured.

Asked what primarily drives their content security initiatives, survey respondents cited general risk avoidance as the top reason, followed by regulatory compliance, corporate policies as well as e-discovery and litigation concerns. But when asked what percentage of their organization's content requires specific controls to ensure their validity and security, 28 percent said they didn't know.

More than 40 percent of respondents said that they had no idea whether any content had been inappropriately accessed within the past two years. And 41 percent said they did not know whether any content had been inappropriately updated or deleted.

"There's almost this reluctance to spend much time and money on [content security] because there's a naive hope that if we never get caught we don't have to worry about it," says Carl Frappaolo, vice president of AIIM Market Intelligence and an author of the report.

AIIM is a professional association that provides market research and education about enterprise content management technologies and practices. Survey respondents included both association members and the general public. The questionnaire, administered online, was designed to provide a general snapshot of corporate knowledge and attitudes about content security issues.

Respondents also reported that making a business case for content security projects is challenging. Though few said they required a formal ROI study to implement content security initiatives, 75 percent of those who did project an ROI did not achieve an acceptable return.

Frappaolo says that's because most companies have a hard time calculating their risks. An exception, he says, is a financial services company with which he worked. "One day an executive happened to notice there was an expense exceeding a million a year for temp services. [The company] was hiring temps to help with e-discovery," Frappaolo recalls. "That's when they decided they could cost-justify bringing in some software. Not everyone is that fortunate to see something like that."

Download the study here.