Smart buildings generate extensive electronic records of physical employee movements, transits, and building entries. Managing these logs requires strict compliance with data minimization and retrievability principles. 1. What is the strict statutory retention period your organization enforces for physical security swipe logs? 2. Have you reviewed your office building lease to confirm who legally owns and controls this swipe-card data—your company or the landlord? Action Item: Email your building facilities lead to formally request the written data retention and access policy for your office's smart key-card system.

Software developers frequently copy active production databases into test environments (sandboxes), creating a massive security and privacy vulnerability. Implementing strict Time-to-Live (TTL) limits and data-masking protocols for development databases closes this invisible loop. 1. How do your IT security policies prevent software engineers from using live, unmasked customer records in their test environments? 2. Do you have an automated process that systematically deletes sandbox databases once a project sprint concludes? Action Item: Draft a simple standard requiring IT to apply data-masking scripts to all databases copied into software development environments.

Outsourcing physical shredding is a great practice, but a lack of control over the locked consoles on your office floors creates a severe security vulnerability. Securely managing physical key custody and transmittal logs prevents sensitive paper documents from leaking before destruction. 1. Who in your facilities team holds the physical keys to the locked paper disposal consoles in your building? 2. Do you require a signed custody transfer form every time your shredding vendor empties a console? Action Item: Locate every physical shredding bin in your office and document the current key holder and key storage location today.

Over-permissive folder structures on shared drives degrade records security and expose sensitive records to unauthorized internal eyes. Restricting these pools to a strict "Least Privilege" model immediately reduces your cyber risk. 1. When was the last time your IT department ran a sweep to identify folders accessible to the 'Everyone' or 'Domain Users' groups? 2. How do you ensure that employees' folder access is instantly updated or revoked the moment they change internal roles? Action Item: Audit the access permissions on one key shared folder containing financial or HR records and remove any overly broad groups.

As employees use generative AI tools like ChatGPT or Microsoft Copilot daily, the prompts they type and the outputs they receive are accumulating rapidly. Under standard information governance principles, these interactions may constitute official business records if they represent corporate decisions or authorizations. 1. Does your organization's information policy officially define whether an AI prompt is a business record? 2. What system do you currently use to capture and preserve the audit logs of your team's generative AI usage? Action Item: Draft a 2-sentence update to your master Information Governance Charter defining the status and retention rules for AI prompt histories.