Limit administrator's access to certain files

Question

Hello, 
 so several of the higher ups at our company(mostly HR) are having problems lately with administrators having access to sensitive documents like wage information and other personal information about employees. Is there anything I can do about this? I was thinking it would ease their mind if I set up the notifications so it notifies them when the document is accessed, but it only gives the option for a check-out. Anyone else had problems like this before, what was your solution? 
 Thanks

Heidi Immonen-Isomäki · Answer

As you mentioned, administrators can access all the documents. One solutions I have witnessed is to limit the access is to protect the documents with passwords. At least Microsoft Office offers this possibility.

Joonas Linkola · Answer

Other things to consider: 
 
 If the administrators are also normal users in these vaults (creating/accessing documents etc.), they should have separate user accounts for admin operations and normal use. They should only log into the vaults with the admin accounts when some administrative work needs to be done. This would already limit the exposure to sensitive documents in their daily work. 
 File downloads are logged to the vault event log , so there could be an auditing process in place to notice any inappropriate file accesses
 
 For added security, the logs could be exported to a secure location that the M-Files administrators cannot access directly (so malicious administrators cannot cover their tracks by deleting log events).

If M-Files is self-hosted, make sure you have enabled encryption of data at rest so server administrators cannot access the file data from the file system: Best Practices for Data Security and High Availability in M-Files (Encryption is enabled by default on M-Files Cloud.) 
 Instead of password-protecting the files, using Azure Information Protection might be an option. More information in section 10 here: M-Files and Microsoft Office 365

Limit administrator's access to certain files

Top Replies