Looking to stay on top of the evolving cybersecurity threats in the document imaging space? Afraid of looking uninformed in front of your clients and prospects? You’re in the right place.
I lead print cybersecurity at Marco Technologies, one of the nation’s largest independently owned managed print services providers, with more than 250,000 devices under contract and growing. That vantage point means fielding the same handful of questions on repeat from IT directors, from boards and from analysts trying to figure out what’s worth worrying about. What follows are the ones that come up most, answered straight, without the sales pitch.
So, how do I secure my print environment? Turning the daunting into the manageable is the name of the game. If you do absolutely nothing else, our recommendation to all customers is to address the following:
Keep Devices Current: Ensure your print environment contains only equipment still supported by the manufacturer, meaning those that still receive security patches and updates. Manufacturer support windows typically run at least 8 years from a device’s release date, and as far as 15 years in extreme cases. In our own analysis of 268 different devices across manufacturers, average security-patch support ran 9.6 years from release.
Keep Devices Updated: Update your MFPs at least once per year, up to quarterly. Only 36% of IT teams apply printer firmware updates promptly, per HP Wolf Security’s 2025 research — so even annual updates put you well ahead of the pack. It is important to note two things, however:
- Proactive firmware updating for security purposes is generally the responsibility of the end customer.
- While A4 printers (HP, Lexmark, etc.) are generally self-updatable given their firmware is public, A3 copier manufacturers (Canon, Konica Minolta, Sharp, Ricoh, etc.) keep files behind service paywalls or specialty management tools. This is a deficiency of the industry, at least from a security lens.
Keep Devices Locked Down: Harden devices, including changing the administrative and service mode passwords, and disabling unused ports, protocols and services. Our technicians use a 2FA-protected portal to store and access these credentials in the field.
Take away? Ensure you know the status of your fleet regarding these three measures and ensure access to firmware is part of any print services agreement you enter. Identify gaps, make a plan and remediate.
What was PrintNightmare? Two 2021 critical vulnerabilities (CVE-2021-1675 and CVE-2021-34527) in the Windows Print Spooler, the background service every networked printer relies on to communicate with Windows, let an attacker execute code with SYSTEM-level privileges. On a domain controller, where the spooler runs by default, that was enough to seize control of the entire domain. Microsoft’s first fixes didn’t fully close the hole, forcing a second round of emergency patches and, for many IT teams, disabling the spooler entirely on servers that didn’t need it.
Take away? Ask your IT team or MSP whether spooler services are patched on the same cycle as the rest of your infrastructure, and whether they’re running on any server that doesn’t strictly need it.
Yes or No on Windows Protected Print (WPP)? Announced in late 2023, this security feature released in Windows 11 version 24H2 in direct response to PrintNightmare. Once activated, the feature locks a device’s printing to Microsoft’s IPP Class Driver, replacing manufacturer drivers which removes users’ ability to leverage extended, driver-based features (e.g., finishing options like staple, hole punch, custom tray mapping and more). Turning WPP off isn’t a clean undo, either: Windows won’t automatically restore the drivers it removed, so you’re reinstalling them by hand.
Take away? We do not recommend WPP on production networks currently, at least not without thorough testing on all applicable makes, models, workflows and supporting print software solutions in your fleet.
What’s this about Post-Quantum Encryption? Quantum computers are devices theorized to be able to break modern encryption algorithms that protect virtually all of today’s digital infrastructure. If and when these devices with enough ‘logical qubits’ (the unit of measure you need a minimum number of to crack encryption) materialize, the underpinnings of all aspects of our modern digital existence will be at risk. But the risk isn’t only in the future: attackers can capture and store encrypted data today, from emails to print jobs, in a strategy known as “harvest now, decrypt later,” banking on being able to decrypt it once quantum computing catches up. Early-mover print manufacturers have already begun releasing MFPs with post-quantum cryptography embedded in some areas of the device — HP, for instance, added quantum-resistant firmware and boot-integrity signing to several Enterprise MFP models in 2025.
Take away? For government agencies, a June 2026 Executive Order (14409) requires federal agencies to migrate high-value systems to PQC by December 31, 2030, an increase from the original 2035 deadline. For everyone else, prioritizing equipment purchases with post-quantum cryptography (PQC) is advisable where all else is equal. The devices you buy today may still be in service in a decade.
Microsoft “SMTP AUTH” is being deprecated? A legacy authentication protocol for Microsoft 365 accounts called SMTP AUTH with basic authentication is being phased out. This protocol supports the majority of Microsoft 365 scan-to-email setups on MFPs, today. At the end of December 2026, Microsoft will switch it off by default for existing tenants; admins can temporarily re-enable it, but Microsoft has been clear that’s a bridge, not a fix. A final, permanent removal date, after which there’s no turning it back on, is expected to be announced in the second half of 2027 (subject to change — Microsoft has revised this timeline before). Because SMTP AUTH is the default scan-to-email method on most fleets, doing nothing means scan-to-email can silently break as early as January 2027.
Take away? Begin testing OAuth 2.0, which may require a firmware update, on your equipment. Identify any devices that cannot be upgraded, and target those for removal or replacement. Bypassing via an SMTP relay through a Microsoft 365 connector is workable, but it’s a weaker security model than OAuth and shouldn’t be treated as a permanent fix.
What is Zero Trust Architecture? It is a guiding principle, not a specific technology, for network design that means you treat all network devices as untrusted. Trust is evaluated per session, constantly reassessed and never assumed to persist. In practice, that means connecting technologies together (an MFP to a print server, for example) through allowlisting, permitting only known, approved connections, instead of the traditional flat network where any device can freely reach any other.
Take away? Because MFPs are often slow to patch, treating them as never fully trusted and isolating them on the network is a smart compensating control that limits the damage if one is compromised. Designing a new architecture is often best done at contract renewal, and technologies like follow-me printing support it well. Include zero trust, or more broadly the principle of least privilege, in your next fleet refresh.
Can you explain the Common Certifications? Every dealer, vendor, and RFP throws these acronyms around. Here’s what each one actually covers, and just as important, what it doesn’t.
FIPS 140-2/3: US government certification program confirming a specific hardware, firmware or software cryptographic module. It does NOT certify that the method used contains the “most secure” encryption and often isn’t. Use only when required (often a separate, specific HDD or device SKU).
Common Criteria (ISO/IEC 15408): This is the international evaluation/certification methodology/framework used to evaluate IT products. “Common Criteria Certified” by itself does NOT tell you much unless you know exactly what was tested and on which device configuration.
IEEE 2600: This is a security standard written specifically for printers, copiers and MFPs. IEEE 2600 is the defined requirements, and IEEE 2600.x Protection Profiles are those requirements translated into Common Criteria-testable profiles. Two different products with IEEE 2600 may NOT have been evaluated against identical functionality or requirements.
SOC 2 Type I / II: This is the methodology (SOC 2) and scope (Type I or II) of an attestation on a company that delivers IT services to others, such as a MPS organization. Controls tested are customized to each report, can be evaluated for design-only at a point in time (Type I) or design AND operating effectiveness over a period of time (Type II), and can cover any combination of the Security domain plus Availability, Processing Integrity, Confidentiality and Privacy. Having a SOC 2 report does NOT mean an organization is secure and preference should aways weight towards Type II.
ISO/IEC 27001: This is arguably the single most requested, global security certification for document imaging companies. It is distinct from all the others — it certifies that a company has a formal, audited process for managing security risk, it does not certify that any specific product is secure. ISO 27001 is the international equivalent of the US-centric SOC 2. It is NOT company-wide in scope by default, as it could be one office or platform — leaving the rest of the business, including the factory that builds your printer, entirely uncovered.
CMMC 2.0: Certification program from the Department of Defense (DoD) for the unclassified-but-controlled portion of defense data, for contractors and subcontractors alike. “Level 2 Certification” is a report produced by an independent, certified auditor, and is a requirement starting November 2026. MPS providers MAY be subcontractors as defined in CMMC. If you store, process, or transmit the defense information (CUI), you are in-scope.
Everything else you’ll hear name-dropped — NIST CSF, GLBA, GDPR, HIPAA, NIST SP 800-53/171, CIS Controls, ‘military-grade encryption’ — isn’t a certification. There’s no auditor, no credential, no third party checking the claim. If a vendor says, “HIPAA certified,” that’s marketing, not proof.
So, now what? Every section above comes down to the same habit: don’t take a label, a certification or a deadline at face value — ask what it actually covers, request the document, check the scope. That’s the real difference between sounding informed and being informed. Bookmark this. The next time someone drops one of these terms during a meeting with customers or colleagues, you’ll have the answer instead of the nod.
Jay Brown
With over 10 years of cybersecurity experience, Jay Brown is the Head of Print Cybersecurity at Marco Technologies, where over 250,000 devices are under contract. He leads a team spanning presales, post-sales, and product development and design, owning the subject of print security end-to-end for the organization. Under his leadership, Marco Technologies has built a comprehensive approach to print security that bridges technical innovation with client-facing strategy. Jay holds a degree in Management Information Systems from the University of Iowa and is a CISSP-certified security professional, with a passion for making the unmanageable digestible and actionable.