I watched a founder fail his own document test last spring. He had a forty-page information security policy, signed by every employee, and he still could not tell me which folder held his 2023 lease amendment. It took him eleven minutes to find it. The buyer’s diligence lead gave us four.
That gap is the whole argument. A written policy describes how you intend to handle sensitive business documents. A drill shows what actually happens when someone asks for them under time pressure. Most companies have the first and have never run the second. If you want to know which of the two protects your next deal, run the exercise below this week. Teams that get this right usually do it on a platform built for it, such as ddraum.de, rather than on a shared drive with good intentions and a naming convention nobody follows.
What the drill actually tests
Set a timer. Pick five documents a real counterparty would ask for: a signed contract, a lease amendment, an insurance certificate, a tax filing, and one piece of correspondence that explains an odd number in your accounts. Hand the list to someone who does not normally touch your file structure. Give them fifteen minutes and a laptop. Write down everything that slows them down.
You are testing four things at once. Can they find the document without help? Can they open it without emailing you for a password? Can they confirm it is the current version? Can you see afterward exactly what they opened and when? Fail any one of those four and your process leans on people remembering things, which is the weakest form of security there is.
See also: Missed an Ozempic Dose? Here’s What to Do
Why the paper version feels safer than it is
Policies get written once and reviewed annually, usually in a meeting where everyone nods. Access rules change weekly. A contractor gets added for a project and never removed. Someone downloads a folder to their desktop so they can work on a flight. That download is still sitting there eight months later, three laptops ago.
According to guidance from the Federal Trade Commission, businesses have a legal duty to protect customer and business records with reasonable safeguards, and what counts as reasonable depends on the sensitivity of the data. A signed policy that your team cannot follow in practice is not a safeguard. It is evidence that you knew the risk and stopped at writing a paragraph about it.
The document nobody can find is the document that costs you
During an M&A process, a single missing document can stall a request list for days. Buyers read delay as a signal. They start wondering what else is buried, and the questions get sharper. I have seen a deal team spend a full week chasing a version of a supply agreement that turned out to be in a personal inbox the whole time.
Here is the reasoning most people skip. Speed in diligence does not come from having fast software. It comes from having an index that a stranger can navigate without your help. That is a preparation problem, not a technology problem, and a drill is the cheapest way to find out whether you have solved it.
The five claims you have to test
Most teams run a drill once, fix the obvious problems, and stop. The useful version is a checklist you repeat, because access drifts back toward chaos the moment the drill ends. Test these five claims, in this order, every quarter:
- I know who can currently open this folder. Pull the access list and check every name against active projects. Anything you cannot explain, remove.
- A new person can find a document in under five minutes. Use someone outside your team. Your own familiarity hides every flaw in your structure.
- Version history is visible without asking me. If two versions exist and the reader cannot tell which one governs, your naming convention has failed.
- Downloads leave a record. You should be able to say who exported what, and when, without guessing.
- Removing access takes one action. If revoking a contractor means three emails and a call, your controls exist on paper only.
Score yourself honestly. Two or more failures means your process depends on memory, and memory walks out the door with every departing employee.
A structure that survives contact with a real buyer
Naming conventions fail because they are too clever. People invent something reasonable in the moment and nobody enforces it. What survives is boring and shallow: one top-level folder per document type, a date at the front of every filename in a fixed format, and a single index file that lists what lives where. Three levels deep at most. If a reader has to click five times, they will start searching by keyword, which means your careful structure is now decorative.
Give every folder a single owner. Not a department, a person with a name. Shared ownership in document systems means nobody actually checks anything, and you will discover this at the worst possible moment.
I would take a shallow, slightly messy structure with real access controls over a beautiful taxonomy that anyone can browse. Between the two, access control is where your actual risk sits. A buyer reading a folder they should not have seen is a far bigger problem than a filename without a date.
What good hygiene looks like across the industry
The Cybersecurity and Infrastructure Security Agency publishes straightforward guidance for protecting sensitive business information, and most of it comes down to knowing where your data lives, limiting who can reach it, and watching for unusual access. None of that requires an enterprise budget. It requires that you stop treating document storage as an afterthought that someone set up in 2019 and nobody has reviewed since.
How to run the first drill without losing a day
Pick a Thursday afternoon. Block ninety minutes. Assign one person to play the outsider, and pick someone who genuinely does not know your file structure. Use a document list you would actually receive in a diligence request. If you do not have that list, the National Institute of Standards and Technology publishes voluntary frameworks for managing information risk that can help you build one. Grab any of them and translate it into the documents a buyer would want from a company your size.
Run it. Time it. Then fix exactly two things before you run it again. Teams that try to fix everything at once usually fix nothing, because the changes collide and get abandoned. Two fixes, then repeat in two weeks with a fresh person and a fresh document list.
The concrete scenario I keep coming back to: a company with twelve employees, three years of contracts, and one shared drive. Their first drill took twenty-two minutes to find four of five documents. Their fourth drill, six weeks later, took under four. Same people, same documents. The only change was that they stopped writing about security and started practicing it, and the platform they moved onto gave them access logs they could actually read.
Start with one honest number
Your policy tells you what you hope happens. The stopwatch tells you what does. You do not need a consultant or a certification to learn which one you have. You need fifteen minutes, one person who has never seen your folders, and the willingness to be annoyed by what they find.
Run it this week. When the timer stops, the gap between where you are and where you assumed you were will be the most useful number you get all quarter. What is your number right now?
