Print governance, not hardware

In short: A modern multifunction printer is a networked endpoint that stores documents, holds credentials and routes traffic, yet it usually sits outside the governance that covers the rest of the IT estate. The questions that matter now are about security, audit trails, accountability and sustainability, not pages per minute. Treat print as part of your governance framework, not a standalone procurement line.

Ask most organisations where their printers sit in the IT estate, and the honest answer is that nobody is quite sure. Servers have an owner. Laptops have a policy. The firewall has someone who loses sleep over it. The multifunction device in the corner has a service contract, a toner cupboard and a vague sense that it belongs to whoever signed the lease. That gap is the subject of this piece, because the gap is where the risk now lives.

For a long time the conversation about office print was a conversation about hardware. How fast does it run, how much does a page cost, how often does it jam, when does the lease end. Those questions still have answers and the answers still matter to the budget. They are no longer the questions that decide whether print is a problem. The device in the corner has quietly become a computer: it has storage, an operating system, network connections, user credentials and a log of everything that has passed through it. The moment that happened, print stopped being a hardware question and became a governance one.

This is not a dramatic claim and it is not new technology. A mid-range multifunction device bought in the last five years already does all of this. What has not kept pace is the way most firms think about the device. The thinking is still anchored to the photocopier it replaced, when in practice it is closer to a small file server that happens to produce paper. The purpose of this article is to set out the four questions that follow from that shift, and to make the case that print belongs inside the same governance framework as the rest of your IT, watched by the same tools, secured by the same identity layer and accounted for in the same numbers.

The printer is an endpoint, not an appliance

Start with what the device actually is. A networked multifunction printer holds an internal drive or solid-state storage. It runs firmware that needs patching like any other operating system. It connects to your directory so that staff can authenticate and print. It scans to email, which means it holds outbound mail credentials. It often has open network ports, a web admin interface and a default password that may or may not have been changed when it was installed. Every document sent to it, scanned through it or copied on it can pass through that storage on the way.

Put plainly: it is an endpoint. If a laptop in your business had an unpatched operating system, a shared admin password, an internal drive full of client documents and a direct line to your email, somebody in IT would treat that as an incident. The same description applied to the printer rarely raises an eyebrow, because the printer does not feel like a computer. It feels like furniture.

The consequence of that perception gap is consistent. Printers are frequently left off the asset register, excluded from the patching cycle, ignored in the access review and forgotten in the data protection assessment. They sit inside the network perimeter, trusted by default, doing sensitive work, governed by nobody in particular. That is the definition of a blind spot, and it is the reason the rest of this piece is structured around four questions rather than four features.

Four questions worth asking

The useful way to approach print governance is not to audit the hardware. It is to ask the questions a regulator, an auditor or a board member would ask, and to see whether you can answer them. There are four, and each one maps to a real exposure.

Are our printers a security risk?

This is the first question and the one most likely to get a shrug. The honest answer for most organisations is that they do not know, which is itself the answer. A printer that ships with a default administrator password, exposes a web interface to the internal network, runs firmware that has not been updated since installation and retains scanned documents on an internal drive is a credible route into the wider estate. It is trusted, it is rarely monitored, and it is exactly the kind of overlooked device that an attacker probes for precisely because everyone else has overlooked it.

The exposure is not only about an outsider getting in. A scan-to-email function that has been misconfigured can send documents to the wrong address. An internal drive that is not encrypted holds readable copies of whatever has passed through it. A device at the end of its lease that is returned to the supplier without its storage being wiped takes years of documents out of the door with it. None of this is exotic. All of it is preventable. Almost none of it gets addressed unless someone has decided that the printer is in scope. The detail of the security blind spot is its own piece; for now the point is that the question has to be asked and answered, not assumed away.

Can we see and prove who printed what?

The second question is about accountability, and it separates two very different positions a firm can be in. In the first, documents are sent to a device and collected from the output tray by whoever gets there. There is no record of who released a given job, no certainty that the right person collected it, and no log to consult if a confidential document is later found somewhere it should not be. In the second position, every user authenticates at the device, jobs are held until the right person releases them, and there is a log of who printed, scanned or copied which document and when.

The difference matters most when something goes wrong. A complaint about how a document was handled, an internal dispute, a regulatory inspection, a data protection query: in each case the question is the same, who did what with this document, and when. A firm that can produce a clear record answers that question in minutes. A firm that cannot is left reconstructing events from memory, which is no answer at all. For organisations in legal, financial services or any regulated sector, the ability to demonstrate a document chain is not a nicety. It is the difference between a compliance position you can assert and one you can prove, and only the second kind survives inspection. This is the subject of the audit-trail piece in this series.

What is print really costing?

The third question is financial, and the honest version of it goes well beyond the cost per page on the contract. Toner is the visible cost, so it is the cost that gets negotiated. The larger costs are the ones nobody puts on a line of the budget: the energy the fleet draws, the waste it produces, the colour printing that happens because nobody set a default to mono, the support time spent on devices that should have been retired, and the slow sprawl of desktop printers that arrive one at a time and never leave. Add the staff hours lost to a device that is down, and the real figure is usually a good deal higher than the contract suggests.

There is an environmental cost sitting alongside the financial one, and increasingly the two are reported together. Energy, paper, consumables and the manufacturing footprint of an oversized fleet all carry weight, and firms now field questions about them from clients, tenders and their own boards. The point of asking what print really costs is not to be alarmed by the number. It is to recognise that you cannot manage a cost you have never measured, and that a fleet which has grown by accretion is almost always larger, hungrier and more expensive than the work requires. The cost-and-sustainability piece takes this further.

Should we run it ourselves, or have it managed?

The fourth question follows naturally from the first three. Once you accept that print needs patching, monitoring, access control, audit logging, right-sizing and cost control, the next question is who does that work. An in-house team can do all of it in principle. The honest issue is whether print competes successfully for that team’s attention against everything else on its list, because in most firms it does not. Printers get attention when they break, not before, and a governance model that only acts on failure is not really a governance model.

A managed service exists to close that gap: proactive monitoring that flags a device before it fails, consumables dispatched on usage rather than panic, a defined response time, periodic fleet reviews that catch sprawl, and security and governance treated as part of the service rather than an afterthought. That is not an argument that managing print in-house is always wrong. For a very small estate of one or two devices, the overhead of a managed contract may not be worth it, and a sensible firm keeps it simple. The comparison piece in this series sets out both sides honestly rather than assuming the answer.

Why this belongs inside one framework

The four questions are usually treated as four separate problems handed to four different people. Security goes to IT. The audit trail goes to compliance. Cost goes to finance. The service decision goes to whoever holds the contract. Each looks at the printer through their own window, and the device falls through the gaps between them.

The argument of this piece is that the four questions are one question wearing four hats, and the device should be governed as a single thing. A printer that is patched and access-controlled (the security answer) is also the printer that produces a reliable audit log (the accountability answer). A fleet that has been right-sized for genuine demand (the cost answer) is also the fleet that is small enough to monitor and secure properly (the security answer again). Pull on any one of the four threads and the others move. Treating them separately means each is solved partly and none is solved well.

Practically, that means print should sit on the same asset register as the rest of the estate, inside the same patching cycle, under the same access and identity controls, visible to the same monitoring, and accounted for in the same budget conversation. It should not be a procurement that runs on its own three-year cycle, reviewed in isolation and forgotten in between. The reason firms struggle to get there is rarely a lack of will. It is that print, telecoms and IT are usually bought from different suppliers reporting to different review cycles, so nothing joins them up.

This is the gap Dragonfly Tech was built to close. Forty years in managed print, combined with unified communications and IT services under one roof, means the printer can be governed the same way the rest of the workplace technology is governed, watched by the same proactive monitoring, secured to the same standard, billed on a single consolidated invoice and reviewed as part of the whole estate rather than a line on its own. That is not a pitch for more technology. It is an argument for fewer fences.

The four pieces that follow each take one of the four questions in turn: the security blind spot, the audit trail, the real cost and sustainability of print, and the honest case for managed versus in-house. Read together they make a single argument, which is that print has earned a place inside the governance framework you already run for everything else. If you want the full picture on print as a governance issue before drilling into any one part, this is the piece that frames it.

The printer in the corner has been quietly doing the work of a computer for years. It is time the governance caught up with it.

Frequently asked questions

Are office printers really a security risk?

Yes, and the risk is usually understated. A networked multifunction printer has internal storage, runs firmware that needs patching, holds credentials for functions like scan-to-email and sits trusted inside your network. Left with default passwords, unpatched firmware or unencrypted storage, it is a credible route in and a place where sensitive documents accumulate. The risk is real precisely because the device is so often overlooked.

Why is print a governance issue rather than just an IT purchase?

Because the device stores, processes and routes documents, which makes it subject to the same security, data protection and audit expectations as any other endpoint. A purchase decision ends when the lease is signed. A governance decision continues for the life of the device: patching, access control, audit logging, cost control and secure disposal. Treating print as a one-off purchase leaves all of that unmanaged.

What should we be measuring beyond cost per page?

Look past toner to the full picture: energy use, waste, the volume of unnecessary colour printing, support time, the number of devices relative to genuine demand, and downtime cost. Add the environmental footprint, which clients and tenders increasingly ask about. A fleet that grew by accretion is almost always larger and more expensive than the work requires, and you cannot reduce a cost you have never measured.

Do we need a managed service to govern print properly?

Not always. A very small estate of one or two devices can often be handled in-house without much overhead. The case for a managed service grows with the size and complexity of the fleet, because proactive monitoring, automated consumables, a defined response time, fleet right-sizing and built-in governance are difficult for an internal team to sustain alongside everything else competing for its attention.

Simon Stratton

Simon leads Dragonfly’s technical team, helping UK SMEs slash carbon footprints, printing costs, and telecoms expenses through smart Managed Print and Telecoms Services. He regularly shares insights on document security, cloud integration, and connected business solutions.”