Versatile 2026 brings together Zasio’s industry-leading information governance solutions in a simple-to-use platform, including electronic records management, retention schedule management, and physical records management. With Versatile 2026, you choose the features you need. Whether it’s gaining control over unstructured documents, tracking boxes across multiple locations, or building domestic or global retention schedules, there’s no need to purchase separate software.

“Versatile 2026 marks an important evolution in how organizations manage and govern their information,” said Kevin Zasio, Founder and CEO. “By unifying physical and electronic records into a single, cohesive collection, we’re removing long-standing barriers and giving organizations a clearer, more complete view of their information.”

Key Enhancements

Building on the success of Versatile 2025, the updated release delivers a more user-friendly experience with a cleaner navigation bar and redesigned home screen that places your most frequently used tools (recent updates, integrated digital repositories, and personal collections of records) front and center. A new floating toolbar keeps shortcuts within reach wherever you navigate.

In another exciting update, Electronic Records Management (ERM) is now fully integrated, putting your key digital assets in the same view as physical records and retention schedules.

“Behind Versatile 2026 is a dedicated team effort centered on elevating electronic records management and enabling seamless retention across physical and electronic records,” Zasio said. “Through extensive development and collaboration, they’ve created a more unified platform where both record types function together as a single cohesive collection.”

The new My Collections feature lets you group mixed content for audits or projects without moving records and makes it easy to share collections with others. Finally, our enhanced AI-powered Versatile Information Assistant (VIA) recommends retention schedules and citations based on user inquiries. VIA can ask clarifying questions to ensure proper context and allows you to browse recommendations before adding them to your existing retention schedule.

Designed for Simplicity and Power

Unlike many applications that become more complex with each update, Zasio ensures each new feature enhances usability.

“We take great care to enrich the user experience while adding functionality,” said Warren Bean, Vice President of Technology and Product Development. “We don’t think you should have to search the internet to figure out how to use our products. It should be intuitive.”

Versatile 2026 represents Zasio’s next major update to the company’s industry-leading information and compliance platform. It’s currently scheduled for release in early May. View the Versatile 2026 feature overview video here. Questions? Visit zasio.com or email connect@zasio.com for details.

###

Founded in 1987, Zasio has nearly 40 years of experience at the forefront of records management and information governance. Zasio prides itself on its ability to foster a culture of innovation mixed with long-term thinking, which translates into offering leading-edge records and information management solutions along with unparalleled support to its customers.

The post Zasio Unveils Versatile 2026: A New Milestone in Records Management Software appeared first on Zasio.

This webinar, hosted by ARMA International, reframes records retention as a core governance mechanism within the Information Governance Integrated Model (IGIM) and a foundational enabler of ARMA’s Generally Accepted Recordkeeping Principles® (The Principles®). Participants will explore how retention requirements sit at the intersection of business value, legal and regulatory obligations, risk management, and technology and how they can be leveraged to drive consistency, accountability, and defensible outcomes across the information lifecycle.

Drawing on real‑world experience, this session will examine how retention schedules support key principles such as Lifecycle Management, Availability, Protection, Compliance, and Transparency, and how they can be operationalized across modern digital environments. Attendees will learn practical strategies for modernizing retention programs, aligning them with IG goals, and embedding them into systems and processes to move beyond policy and into execution.

Whether you are refreshing an existing program or building governance maturity, this session will demonstrate why retention is not just compliance. It is governance in action.

Retention Is Governance: Using Records Schedules as the Backbone of IGIM

When: Thursday, April 30 at 12 p.m. (Mountain)

Presenter: Warren Bean, Vice President of Technology + Product Development

Registration: >>> HERE

The post Retention Is Governance: Using Records Schedules as the Backbone of IGIM appeared first on Zasio.

But behind the scenes, the ISHS had been managing these important collections with aging, unsupported records management tools and no internal records retention schedule. That changed when the state agency partnered with Zasio.

Through the implementation of Zasio’s physical records management solution, Versatile Enterprise (now known as Versatile 2026 with Advanced Physical Records Management) and a comprehensive records retention schedule developed with the help of Zasio’s Consulting Team, the historical society has improved daily operations and strengthened how staff locate, manage, and care for long‑term historical records.

Background

Spanning territorial-era documents from 1863 through manuscript collections, photographs, oral histories, and the archives of city, county, and state agencies, ISHS is responsible for preserving a vast and varied record set. With only 12 staff members, the agency required a system capable of efficiently managing high record volumes while maintaining the rigorous tracking and documentation standards essential to its mission.

Before Versatile, ISHS relied on two outdated systems: a legacy program “not necessarily developed for archives,” and a separate homegrown database at the State Records Center described as being on “life support.”

As State Archives Administrator David Matte noted, the system was unsupported, not user-friendly, and had been built by two programmers who were leaving. The transfer of nearly 35,000 active boxes from the Idaho State Records Center to the Historical Society underscored the need for a more robust and efficient records management system.

Implementing Versatile

After Zasio was selected and Versatile was implemented, day‑to‑day operations at ISHS improved significantly. Tasks that previously took hours (such as printing large spreadsheets and taping them together on a table for monthly billing) became fully automated and far easier and more reliable to manage with our records management software. Staff were able to work more efficiently with faster searching, bulk uploads, and dependable auditing tools (capabilities that simply weren’t possible with the previous systems).

Key improvements include:

• Automated billing and workflow processes, eliminating manual spreadsheet reconciliation.
• Faster, more precise searching, including the ability to drill down into sub‑entities within large agencies.
• Bulk inventory uploads, replacing handwritten box inventories and reducing errors.
• Robust auditing and space‑management tools, enabling staff to verify locations, correct past misplacements, and keep track of every box and its location during the move.

Versatile helped the agency conduct an audit of its archives for the first time. It’s also become a critical tool in the agency’s 50,000-square-foot expansion project (scheduled to open in 2027) and relocation of more than 30 semi-truck loads worth of boxes that will be transported to the new building.

“Versatile is key to the whole expansion project,” David said. “We know where every single box is from every agency and that information will be used in moving to the new building.”

Consulting

While Versatile solved system and workflow challenges, ISHS was in an awkward situation. It still did not have its own internal records retention schedule. Staff had long been responsible for helping and guiding other state agencies on proper retention, yet internally it relied on the general state schedule.

“It always felt a little weird… we should be leaders in that, and we couldn’t completely make the case for our leadership if we ourselves didn’t have a retention schedule,” David said.

The agency had wanted to develop a records retention schedule for years, but budget and timing never aligned. That changed once ISHS partnered with Zasio’s Records Retention Consulting Team. After a positive experience with Versatile, choosing to partner with Zasio to help create a new retention schedule was the obvious next step.

“I didn’t think of anybody else to create a schedule with,” David said.

Working closely with Frank Fazzio, Senior Analyst, ISHS and Zasio worked with departments across the agency to build the schedule. Frank and David went through multiple review sessions to refine, consolidate, and ensure retention rules were “as lean as they could be” while still aligned with the general state schedule.

“The retention schedule is amazing and everybody in the agency was very impressed with it,” David said. “It really has been one of the many highlights during the 18 years I’ve worked here.”

The Result: A Scalable Partnership for Preserving Idaho’s History

David repeatedly emphasized how positive the working relationship with Zasio has been, describing the company as customer‑oriented, highly skilled, and supportive from start to finish. He praised the software and the technical support during Versatile’s implementation. He also recognized Frank who provided steady guidance, and a collaborative approach to build the much-needed retention schedule.

David said he appreciates how Zasio took time to understand how the agency works and structured the project around those needs.

“We couldn’t have done it without Zasio,” he said.

The ISHS’s transformation shows how much of a difference the right software and support can make. ISHS has moved from outdated systems and informal processes to a more organized, efficient operation that’s better prepared for future growth. It can now preserve Idaho’s history with greater accuracy, efficiency, and confidence than ever before.

With Versatile and Zasio’s Consulting Teams’ expertise, ISHS has not only improved operations for today but also put tools in place that will support its work for years to come.

To learn more about Versatile 2026 with Advanced Physical Records Management, and our Consulting services, call 800-513-1000 or email connect@zasio.com

The post Idaho State Historical Society Modernizes Records Management with Zasio’s Versatile software and Consulting Services appeared first on Zasio.

In organizations today, paper records can be as absent as Dictaphones and fax machines. In their place lie complex digital ecosystems, constantly churning and being updated. These ecosystems often cross continents. Within this transformed landscape, records and information management professionals must also adapt. Retention schedules built around documents, even digital ones, are no longer enough to keep organizations compliant with retention and disposition laws. If a digital system can generate a regulated record on demand—or even if it merely contains regulated data—then the system itself must be part of the retention equation. In other words, retention decisions that ignore digital systems create false confidence in your RIM compliance.

The job of RIM professionals now requires data management.

Key Takeaways:

• Traditional RIM focused on static objects; modern RIM focuses on dynamic digital ecosystems.
• Process-driven retention manages the systems and data flows that generate records, not just the records themselves.
• Keeping underlying transactional data while deleting a record creates a “false confidence” in compliance.
• Success requires RIM professionals to master data mapping, system architecture, and cross-departmental collaboration.

The Future of Retention is Process-Driven

It’s helpful to think of computing systems as factories and records as the products being manufactured. It doesn’t matter if you’ve disposed of the end product when the raw material is still on the factory floor and can be used to create another same or a similar record. Under a process-driven retention approach, RIM professionals must focus on how data flows through systems and business processes, recognizing that records are often generated, regenerated, or reconstructed from underlying data long after a record is deleted. Process-driven retention shifts from managing documents to managing the processes and systems that process regulated content.

If an organization determines it must delete a financial report or a customer statement, but it keeps the underlying transactional database, the risk driving the disposition decision has merely been taped over.  In other words, you cannot claim compliance at the record level if the underlying data ecosystem still exists to recreate, substantially reconstruct, or functionally reissue the record.

Process-driven retention builds around the fact that data doesn’t stay in a static state. It’s instead constantly changing. Process-driven retention also appreciates that datasets are often dependent on other datasets to be meaningful. Accordingly, the process-driven RIM professional must recognize that retention outcomes must be determined by system behavior, not just by deleting isolated datapoints. A modern RIM program must be as much about how data systems behave as it is about how long records are kept.

Process-Driven Retention Requires RIM Professionals to be Curious

To adopt a process-driven retention mindset, RIM professionals must elevate their understanding of computing systems and technologies. They must learn new skills and domains. These include data mapping, IT system architecture, and data lifecycles. RIM professionals must begin thinking in terms of the retention implications of computing system event logs, audit trails, system metadata, data pipelines, and even “machine memory” in AI systems.

Process-driven retention also requires creating closer partnerships with privacy, IT, product and engineering teams, and cybersecurity professionals. In a process-driven retention world, these are the RIM professionals’ new cross-collaborators. RIM professionals must be the glue that binds these diverse fields to help their organizations achieve retention and disposition compliance.

New Questions for a New Era of Retention Management

The distinction between “Data,” “information,” and “record” was long an object of worship in the RIM field. Unless the object was a record, RIM professionals need not have been concerned. Such thinking is outmoded. In the process-driven retention age, RIM professionals must think fluidly, thinking through the retention implications of data in all of its forms.

RIM professionals must also shift their focus from classification to system comprehension. Instead of merely asking, “Is this a record?” the RIM professional’s most important question must now be “Show me how this works?”

Additional Resources

To learn more about Zasio’s approach to records retention management, check out our February 2026 Virtual Coffee Webinar with Jennifer Chadband, Warren Bean, and Rick Surber, as well as this written compendium.

Disclaimer: The purpose of this post is to provide general education on information governance topics. The statements are informational only and do not constitute legal advice. If you have specific questions regarding the application of the law to your business activities, you should seek the advice of your legal counsel.

The post How Process-Driven Retention is Changing Records and Information Management appeared first on Zasio.

In litigation, records are not background material. They are evidence. And evidence carries consequences.

When a lawsuit begins, one of the first formal steps is discovery. Discovery requires organizations to produce relevant emails, messages, drafts, reports, and metadata. Opposing counsel does not begin by reading your retention policy. They begin by examining what exists, what is missing, and whether the organization followed its own rules.

As a former trial attorney, I learned quickly that documentation practices often determine outcomes more than dramatic testimony does. An offhand message, a missing file, or irregular deletion can shape credibility long before opening statements begin.

That experience clarified something essential. The purpose of a records and information management solution is not administrative efficiency. It is defensibility. The issue is rarely whether an organization had a policy. The issue is whether it followed that policy when it mattered.

Key Takeaways:

• Shift to Records Management Defensibility: In litigation, your records are evidence, not just administrative files. A judge evaluates your systems based on whether you followed a consistent, repeatable process.
• The Liability of “Keep Everything”: Over-retention expands your discovery footprint, increases legal costs, and creates unnecessary risks during a data breach.
• Consistency is Your Best Defense: Courts don’t penalize organizations for following a reasonable, pre-established retention schedule. They do scrutinize selective or irregular cleanup performed under the shadow of litigation.

How Discovery Tests Your Records Management System

Discovery does more than gather documents. It tests systems. Regulators and opposing counsel approach it with three key questions:

1. Did the organization preserve relevant information once it reasonably anticipated litigation?
2. Did it follow routine practices before that point?
3. Do any gaps suggest unmanaged systems or selective deletion?

In practice, those questions appear in everyday situations:

• A leadership team discusses a major decision in a messaging app, but no one preserves those conversations when a dispute arises.
• An employee deletes text messages, unaware that the issue has already escalated.
• Multiple versions of a contract circulate by email, but no one can identify the final draft.
• A company thinks it has a written policy, yet no one can locate a record of its approval.

None of these situations seem extraordinary until someone asks about them under oath.

How does a judge view missing business records?

Judges do not expect perfection. They expect reasonableness and good faith. Organizations demonstrate that standard through repeatable processes, not polished policy language. When execution lacks consistency, even innocent gaps raise questions. Those questions increase cost, scrutiny, and risk.

Why “Keep Everything” is a Liability

Many organizations assume that keeping all information indefinitely reduces exposure. Leaders believe it is safer to keep everything than to risk deleting something that might later be requested.

In practice, unlimited retention expands risk.

What is the risk of keeping records too long?

When organizations keep more data, they broaden discovery. Broader discovery increases review time, legal costs, and the chance that someone isolates statements from their original context. Redundant drafts and informal communications multiply the material teams must review and explain.

Over-retention also creates operational drag. When everything is saved, nothing is prioritized:

• Employees spend more time searching for the right version of a document.
• Critical information gets buried in outdated files.
• Systems slow.

Storage may be inexpensive. The consequences of excess are not.

The risks extend beyond litigation. The more information an organization keeps, the more it must secure. Sensitive contracts, employee records, personal data, and confidential communications can remain accessible long after they serve a purpose. If a breach occurs, exposure expands with the volume stored.

Defensible deletion strengthens position. Disciplined governance does not destroy evidence—it enforces policy. Courts do not penalize organizations for following a reasonable retention schedule. They do scrutinize selective or irregular cleanup.

The distinction matters. Every retained document can become a witness.

Common Pitfalls in Corporate Information Governance

Risk rarely comes from dramatic misconduct. It grows from small, ordinary gaps that no one thought would matter.

Many organizations manage records responsibly. At the same time, new technologies and decentralized communication add complexity.

Teams make business decisions in messaging and collaboration tools, but those conversations are not always preserved in a searchable way. Managers send texts or use personal devices for convenience. Employees forward work to personal email accounts. Business records are created outside official systems.

Disposition presents another challenge. Organizations often keep records that should be deleted because someone believes they might prove useful someday. Old drafts and unnecessary files build up. Over time, temporary exceptions become permanent practice.

AI adds another layer of complexity. AI tools generate drafts and analyses quickly, and the records questions are not yet settled. Consider a scenario where a team uses an AI tool to draft a legal summary, then revises it through several iterations—if a dispute arises, the organization may struggle to explain which version governed a decision, who reviewed it, and where the prompts and outputs are stored. Governance continues to evolve, but disputes already involve AI-assisted content.

These patterns often go unnoticed until litigation begins. At that point, organizations must explain why certain information was kept indefinitely while other records cannot be located. They must show when preservation began and demonstrate that deletion followed established timelines rather than reacting to scrutiny.

Uncertainty weakens position. Consistency strengthens it.

Litigation-Ready Governance in Practice

Preparing for litigation does not mean assuming it will happen. It means building systems that hold up if it does.

Organizations strengthen defensibility when they tie retention periods to clear drivers such as legal requirements, contractual obligations, or operational need. If asked why a category is kept for a specific period, leaders should have a clear answer. Not a guess.

They must also define preservation triggers clearly. When a dispute arises, employees need to understand what changes and what they must preserve. Consistent disposition remains essential. A defensible program includes regular deletion that follows established timelines. Irregular cleanup creates far more exposure than disciplined retention.

Organizations must govern high-impact communication channels intentionally. If leaders make critical decisions in chat or collaboration tools, the organization must apply the same rigor it applies to email and shared drives. Executives should understand how isolated messages may be interpreted years later, outside their original context.

These measures are not abstract ideals. They are safeguards that influence litigation outcomes.

Credibility Is the Real Asset

In litigation, credibility carries weight.

An organization that can demonstrate a clear retention rationale, consistent execution, and a functioning preservation process begins from a position of strength. An organization that cannot explain its practices begins at a disadvantage. Records governance is not administrative overhead. It is litigation posture.

Where Experience Matters

Designing a litigation-ready records program requires understanding how others examine policies under pressure. It requires anticipating the questions they will ask and the inconsistencies they may challenge.

At Zasio, we help organizations evaluate retention frameworks, assess preparedness, and align policy with operational reality. We focus not only on compliance but on defensibility.

Once litigation begins, records no longer function solely as internal tools. They become evidence that speaks for the organization. The only question is whether your organization’s records management software can withstand scrutiny when ordinary emails are elevated to courtroom exhibits.

Disclaimer: The purpose of this post is to provide general education on information governance topics. The statements are informational only and do not constitute legal advice. If you have specific questions regarding the application of the law to your business activities, you should seek the advice of your legal counsel.

The post What a Trial Lawyer Knows About Defensible Records Management appeared first on Zasio.

This Virtual Coffee with Consulting is about making sense of “AI records.” This includes not only AI generated content and user interactions, but also the records created to support, manage, and govern AI tools, such as training data documentation, model oversight materials, and decision records. We’ll talk through which of these records are regulated or may relate to defensibility, which are not, and why that distinction matters when it comes to retention and risk.This will be a practical, real world conversation focused on the questions records and information professionals are grappling with right now. Our goal is to help you think through where AI fits into your current records management solution, where you might have ind spots, and how to move forward thoughtfully and confidently.

Join Virtual Coffee with Consulting:  Tuesday, May 5, 2026 at 9 a.m. MT 

Registration: HERE

The post From Algorithms to Audit Trails: Managing AI Records End to End appeared first on Zasio.

As organizations grapple with exploding data volumes, evolving privacy laws, and increasingly complex systems, one thing is clear. Old methods can’t keep up. Process‑driven retention offers a path forward.

What is Process-Driven Retention?

Process-driven retention is a strategic information governance framework that determines data lifecycles based on business processes and data dependencies rather than static, document-centric records.

Why Traditional Retention No Longer Works

For decades, retention programs were built around one deceptively simple question: Can I destroy this record? It was a world of self‑contained documents, straightforward classifications, and predictable lifecycles.

But that world is gone.

Modern organizations operate in an environment where:

• Data is no longer self‑contained.
• Information is generated continuously across systems.
• Records are often reconstructed, not stored as static objects.
• Retention schedules rarely cover all the data an organization touches.

This disconnect has opened a gap between what retention schedules say and what actual business processes require.

The Data Explosion Changed the Rules

Data today is not merely an output, it’s the raw material that organizations process, refine, and reuse. The line between “data,” “information,” and “record” is now fluid:

• Data: raw, unstructured bits.
• Information: data given meaning.
• Records: documented evidence of activities.

Traditional schedules were built to manage records, not the sprawling ecosystems of structured and unstructured data that now feed them. So, organizations are increasingly forced to ask: What do we keep? What counts as a record?

These questions aren’t academic. They shape compliance, risk, and efficiency.

Then Privacy Changed the Rules Again

As privacy mandates gained strength, they introduced obligations that frequently conflict with retention requirements. Among the new challenges:

• Right to be forgotten obligations
• Mandatory deletion maximums
• Conflicts with statutory retention minimums
• Data dependencies across systems
• Requirements not covered by most retention schedules

In other words: it’s no longer enough to know when you can delete something. You have to know when you must.

Enter Process‑Driven Retention

Process‑driven retention reframes the conversation around context. Rather than evaluating a piece of information as a standalone object, it looks at how that information flows, transforms, and supports business operations.

It asks not just what the data is, but:

• Who generates it
• Who processes it
• Where it is stored
• What activities rely on it
• What privacy, security, and legal obligations affect it
• What upstream and downstream dependencies bind it

This approach breaks down silos and reveals the true lifecycle of data—not just the record‑keeping lifecycle.

What Makes This Approach Different

Process‑driven retention is:

• Purpose‑driven rather than content‑driven
• Holistic and fabric-oriented, not siloed
• Metadata aware, using context as an asset
• Structured around dependencies, not isolated artifacts
• Supportive of both privacy and operational requirements

It connects the dots across teams such as legal, IT, records management, operations, privacy and creating shared visibility into the data landscape.

Real‑World Examples in Action

The webinar walked through scenarios that highlight the value of process‑driven thinking:

1. Energy Consumption Data in Utilities

Hourly energy logs feed billing, outage reports, efficiency analyses, and forecasting. They also intersect with marketing, customer success, and project management processes. Deleting logs isn’t just a retention question, it’s an operational one.

2. Time Clock Logs in HR

Clock‑in/out data drives timesheets, pay slips, benefits eligibility, PTO management, and performance reviews. The decision to delete this data has far‑reaching implications.

Implementing Process‑Driven Retention

Transitioning to this modern model requires organizational commitment. The webinar outlined key steps:

• Form a cross‑functional steering committee
• Conduct risk and dependency analyses
• Revisit policies and retention schedules
• Map systems and data flows
• Aggregate data where possible
• Align onboarding and offboarding processes across systems

It’s a foundational shift, but one with significant payoffs. Greater compliance clarity, reduced risk, and more resilient information governance overall.

Looking Ahead

As data complexity grows, retention programs must evolve to match. Process‑driven retention equips organizations to manage information with nuance, context, and foresight. It’s not simply a new technique. It’s a modern mindset for a modern data world.

If you’d like guidance on adopting a process‑driven approach, our team is here to help.

Disclaimer: The purpose of this post is to provide general education on information governance consulting. The statements are informational only and do not constitute legal advice. If you have specific questions regarding the application of the law to your business activities, you should seek the advice of your legal counsel.

The post Beyond Records: Why the Future of Retention Is Process Driven appeared first on Zasio.

Despite the convenience of digitization, some records must remain in physical form. Whether for compliance, legal verification, or operational necessity, paper documents support business continuity. And when digital systems go down, physical records provide an essential backup.

The Value of Physical Records

Many industries require certain documents to be retained in their original form. Wet signatures, notarized contracts, and archival materials often carry legal weight that digital copies cannot replicate. Paper – when stored appropriately – can outlast many digital formats. File types, software systems, and storage devices become obsolete, but properly archived physical documents remain readable for ages.

Physical records may also be vital for disaster recovery. Offsite storage ensures that critical documents remain protected from localized threats and can be retrieved quickly if primary offices are damaged or inaccessible.

One threat to digital records is hacking. Hackers can compromise networks through various avenues, including phishing emails, outdated software, or weak or leaked credentials. Once inside, they may deploy ransomware that locks users out, halts operations, and holds data for ransom. This not only causes downtime and financial loss but also erodes customer trust. To help mitigate these risks, organizations should maintain a physical copy of their business continuity and disaster recovery plan onsite. This ensures your BCDR plan remains available if digital systems are compromised.

Risks to Hard Copy Records

Physical records are not without vulnerabilities. Physical records may be destroyed or damaged through natural disasters like fires, floods, and earthquakes. Environment also influences whether physical records remain safe. Humidity, mold, light exposure, and pests can degrade or destroy records.

Security threats aren’t limited to digital systems. Unauthorized access, theft, or tampering can affect physical records, as well. Locked cabinets may no longer be enough. Organizations should implement secure facilities with limited access policies and clear chain of custody procedures to prevent loss or manipulation.

Trends in Offsite Record Storage Solutions

Organizations are turning to advanced offsite storage providers to address physical records related risks. Key trends include:

• Climate-Controlled Facilities and Design: Modern storage centers offer temperature and humidity regulation, fire suppression systems, and flood-resistant design to preserve document integrity and maximize longevity.
• Access and Retrieval Services: Same-day delivery, rush retrieval, and 24/7 emergency access have become standard expectations that enable organizations to request and gain access to files quickly.
• Digital Inventory Systems: Barcoding and digital portals allow organizations to view inventory, request services, and manage retention schedules without ever having to physically touch a box.
• Hybrid Storage Models – Physical + Digital: Many organizations now combine physical storage with digital access, enabling remote retrieval of scanned documents while securely storing originals offsite for compliance or preservation needs.

Modernization in Physical Records Management

Advancements in technology are reshaping how organizations manage physical records, making the process faster, smarter, and more secure.

Location tracking and mobile apps allow organizations to monitor inventory in real-time. Boxes can be tracked and retrievals managed from anywhere, giving teams greater control over their records.

AI has also transformed indexing. Instead of relying on manual categorization, AI-assisted tools automatically tag, classify, and make records searchable. This is particularly valuable in hybrid storage models where physical and digital records coexist and need to be seamlessly connected.

Finally, certified shredding and destruction services provide a secure way to dispose of records and ensure compliance. These services offer auditable documentation, giving organizations confidence that sensitive information has been properly destroyed.

Technological innovations not only help unite physical and digital records systems–they also elevate records management into an integrated and automation-driven process.

Strategic Planning

When comparing offsite storage against onsite storage or digitization, a thorough cost analysis is a must. Some typical costs to consider are:

• Pickup and transportation fees for moving boxes to the facility;
• Monthly storage charges that may be calculated per box or cubic foot;
• Retrieval and delivery fees – increased costs for rush retrievals; and
• Destruction costs.

Offsite storage can deliver long-term savings and compliance benefits, but budgeting can be complicated by fluctuations with usage and unexpected expenses. Storage fees accumulate over time, making small monthly costs add up significantly. Pricing structures between providers can also vary widely, making comparisons tricky. Organizations also need to build flexible budgets to account for unpredictable retrieval and compliance costs.

Conclusion

With enhanced security measures, integrated digital tools, and modern offsite storage options, physical documents remain a vital part of a resilient information program. By embracing technological advancements while honoring regulatory requirements and preservation needs, organizations can build a balanced, future-ready record program that safeguards both physical and digital assets.

Disclaimer: The purpose of this post is to provide general education on information governance topics. The statements are informational only and do not constitute legal advice. If you have specific questions regarding the application of the law to your business activities, you should seek the advice of your legal counsel.

The post Hard Copy Resilience and Offsite Record Storage Trends: Why Physical Records Still Matter appeared first on Zasio.

Information Management Cyber Attacks on the Rise and Legislative Responses

Cyber-attacks have grown increasingly frequent and severe in recent years. The landscape of modern business includes rising numbers of employees working remotely and ever more reliance on e-commerce. These facts introduce more opportunities for cyber-attacks. In addition, perpetrators of these attacks have an increasing number of sophisticated tools at their disposal including AI-assisted technologies. These data breaches come with numerous consequences for businesses from reputational harm to financial losses. According to a study performed by IBM, data breaches cost companies an average of $4.9 million worldwide and nearly double that figure in the United States.

In response to these threats numerous jurisdictions across the world have introduced legislation dealing with data security. In the U.S. alone, 49 states have introduced over 800 bills dealing with cybersecurity with more than 200 of these bills going on to be adopted. In particular, New York’s amendments to its regulations regarding cyber security recently came into effect.

What do New York’s Information Management Cybersecurity Regulations Require?

New York’s 23 NYCRR Part 500 applies to entities regulated by the state’s Banking, Insurance and Financial Services laws. The latest amendments became effective on November 1 and introduced robust cybersecurity measures:

• Annual risk assessments and compliance certifications
• Written cybersecurity policies
• Access privilege controls
• Mandatory multifactor authentication for external network access
• Asset inventory programs to track all information system assets
• Secure disposal of nonpublic information when no longer necessary for business operations

Potential Challenges of Compliance

These requirements ensure robust security and accurate tracking of information throughout its lifecycle, safeguarding data and retaining it for the appropriate duration. To comply with these requirements, businesses must not only adopt rigorous security measures but also have knowledge of what information the business has in its systems and where it is being stored. It also requires identifying all applications and information systems that store, transfer or process information including those of third-party vendors.

Even businesses not subject to New York’s Part 500 can adopt proactive measures to achieve best information management cybersecurity practices and avoid risk. Implementing access controls such as strong passwords and multifactor authentication is critical to preventing unauthorized access. Beyond technical solutions, ensuring that employees receive adequate phishing and cybersecurity awareness training helps strengthen an organization’s first line of defense against threats. Finally, businesses must create an incident response plan to ensure business continuity and recovery if the worst-case scenario does happen.

Final Thoughts

With cyber risks increasing in number and ranging from attempts to phish individuals to advanced ransomware attacks, cybersecurity for records and information management has become a business necessity.  However, these policies and procedures can be difficult to implement with existing information systems. Beyond adopting technical controls, businesses must have complete comprehension into what data it holds, where that data resides, and what applications process it. By adopting these measures businesses ensure compliance with regulations, reduced cyber risks, and greater consumer confidence in cybersecurity standards.

Disclaimer: The purpose of this post is to provide general education on information governance topics. The statements are informational only and do not constitute legal advice. If you have specific questions regarding the application of the law to your business activities, you should seek the advice of your legal counsel.

The post Adapting to Rising Cyber Threats: Lessons from New York’s Latest Regulations appeared first on Zasio.

From AI-driven automation to the growing demand for defensible disposition and digital preservation, the coming year promises big shifts in how businesses manage information.

In this blog, Zasio’s experts share their predictions for 2026.

Jennifer Chadband — Senior Consultant, CRM, IGP, CIPP/E, Licensed Attorney

Records and information software will continue to build momentum towards simpler, more connected ways of working. Evolving technology and tools that automate filing and disposal will make it easier than ever to manage information, freeing teams to focus on higher‑value work. A growing sense of urgency will also accelerate a big shift already underway: viewing records not merely as compliance requirements, but as resources to organize and use to improve decision‑making.

In 2026, this familiar goal will be more vital than ever: build programs that are easy to follow, reduce wasted effort, and maximize the value of the information organizations already possess.

Will Fletcher, General Counsel, CIPP/US/E, IGP

RIM and IG professionals will intensify their focus on capturing and retaining “records of compliance” across the increasingly complex landscape of data privacy and AI regulations.

For data privacy, critical records of compliance include transfer impact assessments, data protection impact assessments, and evidence of DSAR compliance. For AI, they include AI impact assessments, AI architecture documentation, retention and deletion logs for AI inputs and outputs, and the policies and standards that comprise an organization’s responsible AI governance program.

Organizations relying on digital systems and automation must also ensure these systems can produce record outputs on demand, and preserve them for as long as necessary, whether for regulatory investigations or legal defense.

Warren Bean — VP Technology & Product Development, CRM, CISM

• AI agents will require management similar to human users to control identity and access management. This includes which agents can access specific data repositories, what actions they can perform, and how to verify their authenticity.
• Governance frameworks will expand to include human oversight of AI systems and validation of LLMs and inference outcomes.
• Archivists will have to rethink the concept of ‘provenance’—the history of records and information, including their movements and transformations–-in light of AI deepfakes.

Rick Surber, Senior Consultant, CRM, IGP, Licensed Attorney

As AI growth accelerates in 2026, phishing and other information security intrusions will become more convincing and successful. This will cause data breaches to become more common as attackers use AI to automate social engineering and scale their efforts. In response, solid information governance will matter more than ever.

Clear retention rules, continuity planning, strong information security practices, and well-defined response processes will be essential—not to prevent every incident, but to limit impact, speed recovery, and prevent disruptions from escalating into expensive, long-lasting problems.

Stephanie Martin, Vice President of Product Management & Support

Privacy, security, cost, and accuracy concerns will continue to slow adoption of new AI agents, especially for smaller organizations. Large infrastructure costs and regulatory demands without parallel profits will likely accelerate the price of AI services. However, the benefits of AI will be limited if records lack quality, consistent metadata, or proper organization, making data hygiene a prerequisite for success. Accordingly, successful records management will still depend on record quality.

Navigating the Future of Records & Information Management in 2026

Preparing for 2026 requires a strategic alignment of policy, security, and high-quality metadata. Zasio’s enterprise-grade records management software is specifically designed to handle these complexities, offering the automation and defensible disposition tools necessary to stay ahead of the curve.

Contact Zasio today to learn how our experts and technology can help you audit and optimize your RIM program for the future.

Disclaimer: The purpose of this post is to provide general education on information governance topics. The statements are informational only and do not constitute legal advice. If you have specific questions regarding the application of the law to your business activities, you should seek the advice of your legal counsel.

The post What’s Next for RIM and IG? Zasio Experts Share 2026 Trends & Predictions appeared first on Zasio.