Enterprise IPL Playbook — Information Governance

The data flowing through your shop is institutional data. The chain of custody is either auditable or it isn't.

PII chain-of-custody, audit-trail discipline, vendor-spend exposure. Make the in-plant the institution's print-data firewall.

The work that flows through your shop — personalized cultivation for development, patient education materials, benefits-enrollment kits, named-account proposals, outreach sequences — carries institutional PII that has a chain-of-custody requirement the moment it enters your intake queue.

When that work flows through your shop, you control the intake, the composition, the output, the delivery, and the documentation. The chain of custody is in your hands.

When that same work flows to a commercial printer instead, the chain of custody breaks at the vendor boundary. The development office emails a CRM export to a vendor whose MSA says very little about transmission security, access controls, retention terms, or destruction. The compliance officer finds out the data was mishandled when something goes wrong — a donor complaint, a breach notification, a cyber-insurance question that reveals a vendor list nobody had fully reviewed.

The in-plant is the alternative. Not because the in-plant is the lowest bidder or the most convenient vendor. Because the in-plant is inside the institution's data-handling envelope, governed by institutional access controls, subject to the institution's records-retention policy, and staffed by people whose employment relationship with the institution creates a fundamentally different accountability than a commercial vendor's subcontracted workforce.

That argument — keep the highest-stakes institutional PII inside the in-plant — is yours to make. It is the strongest governance case the in-plant brings to any coalition conversation.

Start a Discovery Conversation Download the Outcomes Scorecard

Playbook at a glance

The whole playbook in one view

Coalition partners, maturity arc, build modules, and reporting cadence. The detail follows below; this is the map.

Information Governance playbook diagram. Coalition: Legal and Risk, Compliance, Finance, IT and Security, Audit Committee. Maturity arc: Cost Center, Consulted, Trusted Producer, Operations Expert. Six modules — three to own, three to influence: Variable-data governance, Audit-trail discipline, Vendor-spend exposure mapping, Fleet security partnership with IT, Shadow-print exposure surfacing, Governance summary for leadership.

What it helps you prove

What this playbook helps you prove

The IPL usually does not own the full institutional fleet. IT owns device security configuration. Finance owns cost centers and vendor policy. Compliance owns regulatory interpretation. Legal owns contract risk. Senior leadership owns the governance posture.

The IPL owns the work that flows through the shop.

This playbook helps answer five practical questions:

  1. Which print jobs carry sensitive or regulated information?
  2. Can the shop document the chain of custody for those jobs?
  3. Which variable-data files stay inside the organization and which leave for outside vendors?
  4. Where does shadow print create avoidable exposure?
  5. What should leadership know about print as part of the organization's governance posture?

The goal is calm, practical documentation.

Start inside the shop

Start with what flows through the shop

Begin inside the shop.

If a source file includes patient, resident, donor, employee, applicant, client, account, financial, or other sensitive information, the shop should know how that file entered the workflow and what happened to it after production.

For each sensitive job, the shop should be able to answer a chain-of-custody checklist:

  • Who requested it?
  • What source file came in?
  • Where did the file come from?
  • Who had access to it?
  • What was produced?
  • How was output verified?
  • How was it delivered or mailed?
  • What happened to the source file afterward?

From there, the IPL can help the organization see the larger picture: work that bypasses the shop, data sent to outside vendors, unmanaged devices printing sensitive content, and recurring workflows that need stronger documentation.

The scorecard

The Information Governance scorecard

The metrics fall into two categories: metrics the IPL produces directly from her own shop's intake and documentation records, and institutional metrics the IPL should be able to speak to credibly in a coalition conversation. The metric that travels furthest to an audit committee is audit-trail completeness on regulated-content work. It is also the one you can build from your own shop's records, without waiting for IT to produce a fleet report.

The governance rows of the Outcomes Scorecard. The first three are metrics the IPL produces directly. The remaining rows are institutional metrics the IPL should be able to speak to and reference in coalition conversations.
Metric What it tells the coalition How to track it
Variable-data file chain-of-custody (IPL's primary metric) Whether the institution's PII stayed inside the data-handling envelope from CRM export to mail-out, with documented retention and destruction For every variable-data job: log source file metadata, composition platform, access-control record, output verification, and retention/destruction event. Tag jobs that went to an outside vendor; quantify those as the exposure number Legal will ask about.
Audit-trail completeness on regulated-content work (IPL's primary metric) Whether regulated-content print jobs have a complete chain-of-custody record: requestor, source file, composition, output verification, delivery, retention/destruction Pull a quarterly sample — 10 jobs per regulated category. Score each 0–3 on traceability. Below 2 on any category is a gap the IPL can remediate from within her own shop, without a capital decision or an IT project.
Vendor-spend exposure (IPL's primary metric) Annual institutional spend on outsourced print work where the commercial vendor's data-handling posture is not equivalent to the institution's — paired with the count of vendors holding institutional PII Audit institutional print spend annually, by office and by vendor. For each vendor handling variable data or regulated content, check MSA data-handling terms, SOC 2 / ISO 27001 status, file-transmission protocols, retention-and-destruction terms.
Cost and vendor visibility Whether outsourced print spend can be tied to departments, functions, vendors, and data-handling needs Use this with Finance and Procurement.
Time to retrieve documentation How quickly the shop can answer a records question Test this quarterly. Same day or next business day is a practical target.
Shadow-print exposure Which unmanaged devices produce sensitive work outside the shop IT identifies devices. The IPL identifies workflow reality — what those devices actually produce and with what data classification.
Fleet security posture (institutional metric — speak to it) Whether institutional devices are configured and governed according to IT's baseline IT owns this. The IPL should understand enough to explain the print-workflow dimensions.
Incident-response readiness Whether the organization has a plan for print-related data events The IPL is the right person to help define realistic print scenarios for the runbook.

If you only track three items this quarter, start with variable-data file chain-of-custody, audit-trail completeness on regulated-content work, and vendor-spend exposure. These three do not require a capital decision or an IT project to build — they require documentation discipline and a clear intake process.

The coalition

What each coalition partner cares about

Lead with Legal. That is where the variable-data governance argument lands hardest, and it is the conversation that produces the strongest internal sponsorship for the governance work the in-plant needs to do.

Filter by chair

Legal and Risk Management

Legal and risk management — where sensitive data leaves organizational control

Legal cares where sensitive data leaves organizational control.

In healthcare: General Counsel / Risk Management. In nonprofit: General Counsel, or outside counsel for smaller organizations. In commercial B2B: General Counsel / Risk Manager, or deal counsel reviewing a named-account agreement.

The question she is actually asking: what is the institution's exposure when work that touches institutional PII is sent to a commercial vendor — and can the in-plant be the alternative that keeps the highest-stakes data inside the institution's data-handling envelope? The single biggest unquantified exposure in most institutional print operations is the variable-data work that the development office, the outreach office, or the equivalent function sends to a commercial vendor. The data files contain institutional PII. The vendor's MSA frequently says very little about how the data will be held. The chain of custody breaks at the vendor boundary.

What to bring: one outsourced variable-data workflow, one in-plant alternative with the chain-of-custody documented end-to-end, the commercial-vendor MSA the work used to flow through, and the data-handling gaps named explicitly.

Compliance

Compliance — documentation rather than reconstruction

Compliance cares whether the organization can show what happened when regulated or sensitive print work was produced.

In healthcare: HIPAA Privacy Officer / Joint Commission liaison. In senior living: State Survey Readiness Officer / Resident Rights Officer. In nonprofit: Grant Compliance Officer / Program Audit Lead. In commercial B2B: Regulatory Compliance Officer or the named compliance lead for the firm's framework (SOC 2, federal procurement compliance, sector-specific certifications).

She does not need to be alarmed about regulatory exposure — she lives with it. What she wants is the audit-trail completeness on regulated-content work that lets her answer the regulatory question — an OCR complaint, an audit, a state-privacy-statute inquiry, a grant audit, a SOC 2 finding — with documentation rather than reconstruction.

What to bring: a sample audit of sensitive jobs. Show the shop's 0–3 traceability scores, what the shop can document today, and which gaps the shop can fix immediately.

Finance

Finance — cost visibility and vendor exposure

Finance cares whether print costs and vendor exposure can be explained to the board, auditors, and records requests.

In healthcare: CFO (bond-rating scrutiny). In senior living: CFO (owner-group and investor scrutiny). In nonprofit: CFO / Finance Director. In commercial B2B: CFO / Controller.

Her operational pain: the institution's print spending is real, and in most institutions it is invisible at the level of granularity the board, the auditor, or the eventual records request asks for.

What to bring: known outside spend, recurring job categories, vendor names, in-plant alternatives, cost comparisons, and the vendor-consolidation roadmap. The vendor count holding institutional PII is the number that concentrates the conversation.

IT and Security

IT and security — the workflow picture a network scan cannot produce

IT cares whether print workflows are visible enough to govern. The print fleet is one endpoint class among many — and probably the one IT has reviewed least. IT may know which devices are managed. It may not know what kind of information those devices actually produce.

In healthcare: CISO or Health Information Officer. In senior living: IT Director / CIO. In commercial B2B: CISO or IT Director.

What IT needs from the in-plant is not the IPL to run the fleet security platform. What IT needs is a partner who understands the print-workflow side well enough to carry half the conversation — who knows what regulated content flows through which devices, and where the chain of custody is most vulnerable when a device is not on a managed platform.

What to bring: the workflow picture, not a platform recommendation. Show which sensitive jobs move through the shop, which appear to happen outside the shop, and where unmanaged devices may be carrying work that belongs in a governed path. That is information IT cannot get from a network scan alone.

Audit Committee / Senior Leadership

Audit committee or senior leadership — print as part of the governance posture

The audit committee evaluates whether the print environment is being managed as part of the institution's information-governance posture, or whether it has been an unreviewed endpoint that an external auditor may eventually surface.

In healthcare: Board Audit & Compliance Committee. In nonprofit: Board Audit Committee. In commercial B2B: Audit Committee or Ownership Group Audit function.

This conversation should begin with work, cost, timing, and opportunity. Equipment comes later. The IPL should bring operational truth and be co-sponsored by the CFO and IT director — do not walk in unsponsored. The in-plant's credibility in that room is a function of the sponsors' credibility, and the sponsors' willingness to carry the print-governance conversation is a function of the metrics the IPL has produced over the preceding quarters.

The maturity path

Where your print governance stands today

Level 1
Cost Center
High-stakes data-driven work flows to commercial vendors — Legal has probably never reviewed those relationships.
Read the full description
High-stakes communications work — variable-data cultivation, patient outreach, recruiting, named-account campaigns — flows to commercial printers or mail houses. The in-plant handles standard materials. The data-handling exposure lives entirely outside the institution's envelope, in vendor relationships Legal has probably never reviewed. The in-plant is operationally competent; it is institutionally invisible on the work that matters most.
Where most shops live today
Level 2
Consulted
The shop quotes on personalized work occasionally, but chain-of-custody is undocumented.
Read the full description
Development, outreach, or recruiting staff occasionally ask the in-plant to quote on personalized work, usually on the basis of cost or turnaround. The in-plant may win some of that work. There is no documented chain-of-custody for how the data file is handled, no formal CRM integration, no retention-and-destruction discipline per institutional policy. Legal does not yet know the in-plant is handling institutional PII.
The move that changes the conversation
Level 3
Trusted Producer
Variable-data work runs in-house with documented chain-of-custody — and Legal knows it.
Read the full description
Variable-data work for one or more major institutional functions runs in-house with documented chain-of-custody: controlled file intake, access-control discipline, composition inside the institution's domain, retention-and-destruction per institutional policy. The vendor-spend exposure analysis is documented. Legal or the compliance officer knows the in-plant is handling this work and trusts the process.
Level 4
Operations Expert
The in-plant is the institution's print-data firewall — and contributes to the annual governance report.
Read the full description
Variable-data work for the institution's major communications functions runs inside the in-plant's data-handling envelope as a matter of institutional policy, not individual preference. The audit trail is complete across all regulated-content categories. The vendor-spend exposure is documented and declining. The General Counsel references the in-plant in cyber-insurance conversations as a positive signal. The CFO's vendor-consolidation roadmap names the in-plant as the primary destination for print-related PII work. IT sees the in-plant as a fleet-governance partner. The in-plant contributes to the annual governance report to the audit committee.
The leverage point is rarely "upgrade the fleet" — that is IT's project. The leverage point is to upgrade the in-plant's institutional standing on the work that matters. The path from Cost Center to Operations Expert runs through the first two modules: get the variable-data chain-of-custody discipline in place, build the audit trail on regulated-content work, and produce the vendor-spend exposure analysis that makes Legal's case for you. Once those three exist, the conversation with IT, Finance, and the audit committee changes.

The build-out

Six modules. Own three. Influence three.

— OWN —

01
Build variable-data governance — keep the sensitive data inside the in-plant
The IPL's strongest governance argument — and the most direct expression of what the in-plant does differently.
Read the full description

This is the IPL's strongest governance argument and the most direct expression of what the in-plant does differently than a commercial printer.

On the advocacy side: build the conversation with development, outreach, patient communications, and any function that sends personalized, data-driven work to an outside vendor. The outside vendor's MSA frequently says very little about transmission security, access controls, retention, destruction, or breach notification. The in-plant alternative is the same work produced inside the institution's domain, governed by institutional access controls, with a chain of custody that does not break at a vendor boundary. Frame the conversation around Legal's exposure, not around print-quality comparisons.

On the stewardship side: license variable-data composition (XMPie PersonalEffect, FusionPro Producer, or Fiery variable-data tools) inside the in-plant. Build integration with institutional CRMs and data systems over secure institutional channels with vertical-appropriate data-handling discipline — HIPAA for healthcare, donor-data stewardship for nonprofits, named-account confidentiality for commercial B2B. Build role-based access controls at the composition platform. Build retention-and-destruction discipline per the institution's records-retention policy.

For every variable-data job: log source file metadata, composition platform, access-control record, output verification, and retention/destruction event. Tag jobs that went to an outside vendor instead; quantify the exposure number.

Measure: variable-data file chain-of-custody, vendor-spend exposure on variable-data work specifically, and the documented Legal exposure-reduction case in dollar terms.

02
Build audit-trail discipline — document what flows through the shop
Entirely within the IPL's control. No capital decision, no IT project — just intake discipline.
Read the full description

The audit-trail discipline on regulated-content work is entirely within the IPL's control. No capital decision required. No IT project required.

What is required is a consistent intake-and-documentation practice that captures: requestor identity, source file metadata (file name, record count, source system, date of export), composition template, output verification, delivery confirmation, and retention/destruction event per the institution's records-retention policy.

Hold regulated-content work to elevated traceability — score 3 on a 0–3 chain-of-custody audit, not score 2. Build the quarterly internal practice: pull a random sample of 10 regulated-content jobs per category, score traceability, fix the gaps, document the audit.

Vertical calibration: in healthcare, the regulated-content categories are patient education materials, discharge instructions, and benefits-enrollment kits with PHI exposure. In nonprofits: grant-recipient communications and donor-cultivation work with CRM data. In commercial B2B: named-account proposals, federal-procurement submissions, and customer-facing materials with confidential business data.

Measure: audit-trail completeness on regulated-content work by category, time-to-retrieve on a sample records request (target: under 24 hours), and audit-sample remediation cycle time.

03
Map outside vendor data exposure — the IPL's business case to Finance and Legal
Run the vendor-consolidation analysis on unit economics AND data-handling posture.
Read the full description

Run the vendor-consolidation analysis on two dimensions for each outside vendor: unit-economics delta versus in-plant production at the institution's actual volume, and data-handling posture (MSA contents, SOC 2 / ISO 27001 status, NDA-and-training posture, file-transmission protocols, retention-and-destruction terms).

Identify vendors whose work could be absorbed in-plant on unit-economics grounds alone. Identify additional vendors whose work should be absorbed in-plant on data-handling-posture grounds even if the unit economics are closer to break-even. Identify residual vendors whose work the in-plant cannot absorb and whose MSAs should be tightened to institutional data-handling standards.

In-plants that have run this analysis systematically have documented meaningful savings — some exceeding $1 million — through vendor consolidation and shadow-print reduction. The in-plant is the best-positioned person in the institution to produce this analysis. Finance and Procurement typically cannot see both the production economics and the data-handling dimensions of the outside-vendor relationship simultaneously.

Measure: vendor-spend exposure trend over time, vendor count holding institutional PII trend over time, documented savings produced, and in-plant share recovery on previously-outsourced work.

04
Partner with IT on fleet security context — INFLUENCE —
Carry the print-workflow side of IT's governance conversation, one sensitive workflow at a time.
Read the full description

The institutional fleet's security configuration — identity-based authentication, audit logging, firmware currency, cloud-managed drift detection — is IT's domain. The IPL did not procure the fleet and does not manage its configuration.

What the IPL can do is understand the governance posture well enough to carry the print-workflow dimensions of the conversation: what regulated-content work moves through which devices, why configuration drift on a device running HIPAA-sensitive patient education creates a different exposure than drift on a general-purpose office device, and where the chain of custody is most vulnerable when a device is not on a managed platform.

Review one sensitive workflow at a time with IT. Identify which devices touch the workflow, whether secure release is needed, and whether the work could move to the in-plant or a managed device path.

Measure: sensitive workflows reviewed and workflows moved to a more governed path.

05
Surface shadow-print exposure — the picture IT cannot see from a network scan alone
Surface what unmanaged devices are actually printing — and move regulated-content work to a governed path.
Read the full description

IT can run a network discovery scan and produce a count of unmanaged print devices. What IT cannot produce from that scan is what those devices are printing, with what data classification, and how often.

The desktop printer in the social worker's office running PHI-adjacent case notes. The development coordinator's printer running donor briefing materials. The account manager's printer running proposal drafts with named-account confidential data. The IPL surfaces that picture — not by running a network audit, but by knowing the institution's print workflows from the inside.

When work running on an unmanaged device with regulated-content exposure can be moved to the in-plant or to a managed device with follow-me release, the IPL has both the operational case and the governance case for the consolidation.

Measure: shadow workflows identified, workflows moved, and documentation improved.

06
Build the governance summary for leadership
Translate the baseline for the coalition — quarterly to the CFO and cabinet, annually to the audit committee.
Read the full description

Once the shop has a baseline, translate it for the coalition.

The annual governance report from the in-plant to the audit committee or board oversight function should be co-sponsored by the CFO and the IT director. The headline metrics the IPL produces directly: audit-trail completeness on regulated-content work, variable-data file chain-of-custody, vendor-spend exposure, cost-by-cost-center reporting completeness. The institutional metrics the IPL references and contextualizes: configuration baseline adherence, shadow-print exposure, configuration-drift incidents.

Quarterly cadence to the CFO and cabinet. Annually to the audit committee in the strategic-plan reporting cycle.

Keep the governance summary short: sensitive work tracked, chain-of-custody completeness, variable-data jobs handled inside the shop, outsourced data-driven work identified, shadow-print workflows surfaced, IT / Finance / Compliance / Legal actions needed, and recommended next 90-day step.

Measure: reporting cadence and decisions made from the summary.

Modules 1 and 2 require no capital decision or IT project to build — they require documentation discipline and a clear intake process. Module 1 has a software investment inside it (the variable-data composition platform) that the IPL initiates and the institution funds; the business case is Legal's exposure-reduction argument, not a print-economics argument.

The 90-day baseline

A practical 90-day baseline

Choose one sensitive workflow and baseline it for 90 days.

Use this checklist:

  • Workflow owner
  • Source data used
  • File transfer method
  • Access permissions
  • Output produced
  • Verification step
  • Delivery or mailing confirmation
  • File retention or destruction
  • Outside vendor involvement
  • Missing documentation

At the end of 90 days, write a one-page summary. Name what was tracked, what sensitive information was involved, what documentation existed, what was missing, what the shop can fix now, and what requires institutional partnership.

That one page becomes the start of the governance conversation.

Beyond print

When the conversation moves beyond print

SumnerOne does not run an operational SOC or sell EDR/SIEM tooling. SumnerOne Tech Leadership handles strategic cybersecurity advisory work: EDR evaluation, SIEM selection, posture review, AI governance, MSP audit. The Legal conversation is where strategic-advisory referrals most often surface — when the conversation moves beyond print-fleet governance to broader institutional cybersecurity strategy, the referral path exists.

See SumnerOne Tech Leadership →

Closing

Start with one sensitive workflow.

You do not need to build the institution's full print-governance posture in one quarter. Choose the sensitive workflow your shop already touches, document it for 90 days, and bring the chain-of-custody picture to the one coalition member who most needs to see it.

That is how the shop moves from the endpoint nobody has reviewed to the institution's print-data firewall.

Start a Discovery Conversation Download the Outcomes Scorecard