2026 | Issue 2
The Quarterly Publication of the International Secure Information Governance & Management Association
TM
INSIGHTS FOR A SECURE WORLD Your Most Underutilized Sales Team Wears Work Boots Inside the Buyer’s Mind and Preparing Your Exit Strategy Turn Cyber Risk Into Opportunity: What to Know About putting Cybersecurity into place SOC 2 vs. NAID AAA: Understanding the Differences
Issue 2 SIGNAL 2026 1
i-SIGMA'S NAID AAA CERTIFICATION PROGRAM
OTHER
WHEN IT COMES TO SERVICE PROVIDER QUALIFICATIONS, CHOOSE THE CERTIFICATION PROGRAM WITH STRENGTH AND INTEGRITY. Due Diligence Comparison
Audit Quality
All NAID AAA Certified service providers are subject to regularly scheduled, onsite audits by trained, accredited security professionals. In addition, random, unannounced audits are structured so NAID AAA Certified operators will not know when they will be audited next.
Regulatory Alignment
The program requires written policies and procedures for each company to ensure incident response preparedness, employee training, and regulatory compliance.
Security Specifications
Accredited auditors review employee background screening and training, compliance with written procedures, access controls, operational security, destruction equipment, and confidentiality agreements.
Free Compliance Monitoring
A customer may monitor compliance by subscribing to email notifications of the service provider’s certification renewal, audit, or lapse.
Oversight
The Certification Committee and the Member Resolution Council oversees the program’s integrity, both of which contain industry veterans and outside, accredited professionals.
Transparency
All documents and specifications are available to the public for free and online. Audit reports and compliance monitoring services are also provided to clients at no charge. The association’s financial records and board of director’s meeting minutes are available online as well. More than 2,000 operations on five continents are certified by i-SIGMA, including
Program mobile, facility-based, paper, and electronic media destruction services. i-SIGMA Acceptance NAID AAA Certification is required by hundreds of government offices and thousands
Program Recognition
i-SIGMA's NAID AAA Certification is acknowledged by many accreditation programs, such as e-Stewards, the state of New Jersey for on-site hard drive destruction, and BitRaser Data Eraser Software Company.
For more on the depth and integrity of the i-SIGMA Certification Program, contact the Certification Department at certification@isigmaonline.org or 602-788-6243. 2 SIGNAL 2026 Issue 2
CONTENTS D E PA R T MENTS 5
A Message From the Editor
6
President’s Message
26 Member News 28 Association News 32 Welcome New Members
8 Your Most Underutilized Sales Team Wears Work Boots
Why Drivers Are a Hidden Growth Engine in the InformationManagement Industry
14 Inside the Buyer’s Mind and Preparing Your Exit Strategy How can business owners anticipate the biggest priorities of eventual buyers?
18 Turn Cyber Risk Into Opportunity: What to Know About putting Cybersecurity into place.
22 SOC 2 vs. NAID AAA: Understanding the Differences A Guide to Two Leading Compliance Frameworks
34 Advertisers Index 34 Upcoming Events
The i-SIGMA Signal is published four times per year by the International Secure Information Governance & Management Association™ (i-SIGMA®). The opinions of authors are not necessarily those of i-SIGMA, its volunteer leaders, or its management. Unsolicited articles and manuscripts are accepted. i-SIGMA reserves the right to edit and publish materials submitted at its discretion. Advertisements submitted for publication are accepted on an as-is basis and i-SIGMA takes no responsibility for their content or placement. i-SIGMA reserves the right to deny advertisement placement to any company or individual based upon the propriety of the content, images, or messages therein, and insofar as an advertisement presents false information, is injurious to the contract information destruction/RIM industry, contrary to the mission of i-SIGMA, and/or the wellbeing of its members. Please address all comments or inquiries to i-SIGMA Signal, 3030 N. 3rd St., Suite 940, Phoenix, AZ 85012. i-SIGMA can be reached at 602-788-6243 or media@isigmaonline.org. © 2026 i-SIGMA - All Rights Reserved
Issue 2 SIGNAL 2026 1
I N T E R N AT I O N A L HEADQUARTERS 3030 N. Central Ave., Suite 706 Phoenix, AZ 85012 602-788-6243 480-658-2088 (fax) info@isigmaonline.org www.isigmaonline.org
i-SIGMA Administrative Contacts NATHAN CAMPBELL Chief Executive Officer Extension 2001 GINA LENTINE, CSDS Editor-in-Chief / Vice President of Marketing & Events Extension 2008
i-SIGMA 2026-2027 BOARD OF DIRECTORS E XE C U TIV E TE AM President Gaines Garrett, CSDS Secure Shredding & Recycling NAID AAA Certified Baton Rouge, LA, USAA
Past-President Rick Jackson American Document Services NAID AAA Certified Las Cruces, NM, USA
President-Elect James W. Dowse, CSDS NAID AAA Certified Time Shred Services, Inc. Hillside, NJ, USA
Treasurer Bowman Richards, CSDS Richards & Richards, LLC NAID AAA Certified Nashville, TN, USA
Secretary Heather Fitzanko, CSDS NAID AAA Certified AAA Certified Confidential Security Corp. Peoria, IL, USA
Executive Director Nathan Campbell i-SIGMA San Francisco, CA, USA
JENNIE GIFT, CSDS, CRA Vice President of Member Services Extension 2009 KENT RODGERS Vice President of Certification Extension 2006 MAGGIE SCHEIN Marketing Manager Extension 2003 KAREN LYONS, CSDS Regulatory Compliance Manager Extension 2011 SHAINA VAN KILSDONK Certification Associate Extension 2020 VICTORIA VALE Certification Associate Extension 2004 JENA ROBINSON Business Support Manager Extension 2010 VANESSA PEREZ Member Services Associate Extension 2007
2 SIGNAL 2026 Issue 2
DIR E CTO RS Amado Cabrera Iron Mountain NAID AAA Certified & PRISM Privacy+ Certified Fort Lauderdale, FL, USA
Amanda Cavanah, CSDS Access NAID AAA Certified & PRISM Privacy+ Certified Madison, WI, USA
Greg Bullard Corodata Records Managment. NAID AAA Certified & PRISM Privacy+ Certified Poway, California
Rod Ivey RecordXpress PRISM Privacy+ Certified Coquitlam, BC, Canada
Derald Miller Shred Northwest, Inc. NAID AAA Certified Boring, OR, USA
Luke Westerman Big Bear Shredding NAID AAA Certified Springfield, MO, USA
Paul Prokic G1 Asset Management Pty Ltd NAID AAA Certified Yatala, Queensland, Australia
Karen Truebody AGS Records Management PRISM Privacy+ Certified Johannesburg, Gauteng, South Africa
Scott Reis uRISQ/CSR Privacy Solutions Jensen Beach, FL, USA
3 Jakes...30 Years...
Still Your Best Friend in Document Protection!
JAKECONNORANDCREW.COM
Issue 2 SIGNAL 2026 3
Safer by Design From our operator controls to physical safeguards, each Shred-Tech truck incorporates more than a dozen integrated safety features. Intentionally designed to minimize risk for both operators and bystanders. • • • • • • •
Intelligent shred system logic Interlocks to prevent unsafe operation Guarded access points Enclosed bin tunnel Pneumatic feed hopper Dual camera monitoring Redundant emergency stops
• • • • • • •
Parallel ignition Smart auger compaction Wheel chocks & cones Auto-neutral & Bendix® IntelliPark™ Maintenance, service, & fault notifications Walking floor pause & resume In-cab stowage alerts
In an industry built around compliance and risk management, we engineer for the risks you see and the ones you don’t. See how we build safety into every truck at Booth #301.
LEARN MORE AT SHRED-TECH.COM | 1-800-465-3214 | SALES@SHRED-TECH.COM
4 SIGNAL 2026 Issue 2
editor ’s letter Welcome to the i-SIGMA Signal: Insights for a Secure World If our inaugural issue was about introducing a new chapter, this one is about looking forward—deliberately, practically, and with confidence. The theme running through this edition is a simple but powerful idea: the future of our industry will be shaped by the decisions we make today. Every article in these pages asks you to think ahead. Jeff Green’s cover feature, “Your Most Underutilized Sales Team Wears Work Boots,” challenges us to rethink the role of the people closest to our customers. His argument is that growth isn’t only found in new markets or new technology—it’s already riding on your trucks, making a hundred stops a week. The operators who design for that reality will out-compete the ones who don’t. Jim Teske takes the long view in “Inside the Buyer’s Mind and Preparing Your Exit Strategy.” Whether your timeline is three months or thirty years, his message is the same: it’s rarely a question of if you’ll sell, but when—and the businesses that command the best outcomes are the ones built, from today onward, to be worth buying. Looking ahead is also at the heart of Karen Lyons’ piece on cybersecurity. New expectations are coming to both NAID AAA and PRISM Privacy+, and members who begin preparing now—written policies, access controls, annual security risk analysis—won’t just be ready for certification. They’ll be ready for a marketplace where digital security is every bit as important as physical security. Our companion guide comparing SOC 2 and NAID AAA gives you the vocabulary to have that conversation with clients and prospects. The forward momentum extends beyond these pages. In Association News, you’ll find an update on the SBA’s proposed changes to small business size standards—with a public comment deadline of September 21, this is a “read it now” item for anyone in federal contracting. You’ll also find a heartfelt farewell from W. Price Brannon, whose stewardship of the certification program leaves it stronger than he found it, and a warm welcome to Kent Rodgers as our new Vice President of Certification. Transitions like these are how a healthy organization renews itself. And there is much to look forward to together. Shred School returns October 7–8 in Milwaukee, and in November we take the conversation global with the International Summit in Bangkok, Thailand—a reflection of just how far this community reaches. The Signal itself will keep evolving too. This publication was never meant to be static; it’s shaped by our industry, informed by your needs, and refined with every issue. If there’s a topic you want covered, a question you want answered, or a story worth telling, we want to hear it. The future doesn’t arrive all at once. It arrives one route, one contract, one policy, one issue at a time. Thank you for building it with us. Warm regards, Gina Lentine Vice President of Marketing & Events i-SIGMA
Issue 2 SIGNAL 2026 5
president’s message As we enter fall, I want to take a moment to reflect on the strong momentum across our association and the industry as a whole. Our conference in San Diego was a clear reminder of the strength of this community. The level of engagement, the quality of discussion, and the willingness of members to share ideas and best practices all point to an organization that continues to evolve and lead. Equally important, we are operating from a position of strength. i-SIGMA is in the best financial position it has been in since my time on the board began five years ago. That stability allows us to invest thoughtfully in the future and focus on the areas that matter most to our members. Looking ahead, one of our key priorities is ensuring that our certification programs continue to set the standard for the industry while also supporting our broader advocacy efforts. As regulatory scrutiny increases at the federal, state, and local levels, it is critical that we clearly demonstrate the value of certification not only as a mark of operational excellence, but as a recognized framework for compliance, security, and accountability. We are actively enhancing our certification programs to better align with these evolving expectations. This includes strengthening how we communicate the value of certification to external stakeholders and ensuring it remains central in conversations with policymakers and regulators. Our goal is simple: When governments and organizations think about secure information destruction and IT asset disposition, they should immediately recognize Privacy+ and NAID AAA Certifications as the benchmark. None of this happens without the continued support of our members, corporate partners, and staff. The progress we are making is a direct result of your engagement and commitment to raising the standard across the industry. In closing, I want to extend my sincere thanks to our Board of Directors for their continued commitment to this organization. Their willingness to invest time, share their expertise, and engage thoughtfully on the challenges and opportunities in front of us is what allows i-SIGMA to continue moving forward. The progress we are making on certification, advocacy, and member value is a direct reflection of their leadership and dedication to the industry. I am excited about the direction we are heading and the opportunities ahead. Thank you for being an active part of this community and for helping to shape the future of i-SIGMA. Onward and upward!
Gaines Garrett, i-SIGMA President, 2026 6 SIGNAL 2026 Issue 2
Issue 2 SIGNAL 2026 7
Your Most Underutilized Sales Team Wears Work Boots Jeff Green
A few years ago, I lost a long-standing customer in a regulated industry. There was no warning from the sales team. No flag from customer service. No complaint, no escalation, nothing in the CRM. The account simply gave notice and was gone. What stung the most came a week later, when one of our drivers told me he had seen a competitor’s truck at that location for the past two months and figured we already knew. We didn’t. We had a person inside that account every two weeks, and the intelligence we needed to save the business was sitting in a pair of work boots the whole time.
variability, that’s somewhere north of 5,000 individual customer interactions per driver. A team of eight drivers will produce more than 40,000 customer touchpoints in a year. No sales team, no matter how aggressive, can match that footprint. Now layer in what they actually see on those visits. Drivers walk past competitor trucks in the parking lot. They notice overflowing bins, cardboard piling up next to shred consoles, new construction, fresh signage, departments being moved, and unfamiliar faces. They overhear the receptionist complain about the service schedule. They watch the customer’s headcount grow or shrink in real time. Very little of this shows up in a quarterly business review. Most of it shows up on a route sheet, if anyone is asking.
That moment changed how I think about our industry. In secure information management, whether shredding, records storage, ITAD, or media destruction, we tend to focus on the salesperson and pay less attention to the person who actually lives with our customers. Salespeople The financial implications are not abstract. visit accounts. Drivers live there. For a lot of Decades of customer-economics research from operators, the gap between those two facts is Frederick Reichheld and Bain & Company have worth real money. shown that even a five-percent improvement in The Math Most Operators Have Never Run customer retention can drive meaningful profit gains in a typical service business. The original Start with a simple comparison. A typical outside 1990 work by Reichheld and W. Earl Sasser sales rep in our industry touches ten to fifteen (“Zero Defections: Quality Comes to Services,” accounts a week. A route driver makes roughly Harvard Business Review, September–October one hundred stops a week. Across a year, even 1990) documented that a five-percent reduction accounting for vacation, holidays, and route in defections generated 85 percent more profit 8 SIGNAL 2026 Issue 2
in one bank’s branch system. Subsequent research has consistently found that acquiring a new customer is generally more expensive than retaining an existing one. In a route-based business, the person best positioned to flag a defection before it happens is the person at the back of the truck. There is parallel evidence on the upside on driving growth rather than just protecting it. A study published in the Journal of Marketing by researchers at Wharton and Goethe University Frankfurt (Schmitt, Skiera & Van den Bulte, 2011) found that referred customers had a customer lifetime value approximately 16 percent higher than comparable non-referred customers, with retention rates roughly 18 percent higher over a multi-year horizon. Those are the kinds of customers your drivers are well positioned to bring in: friends of existing customers, neighbors in the office park, the tenant down the hall who just signed a lease. Referred customers tend to be higher-margin, stickier, and more cost-effective to acquire than customers obtained through traditional outbound channels. Salespeople visit accounts. Drivers live there. Why This Often Doesn’t Happen Today If the opportunity is so clear, why is it underdeveloped at many companies in our industry? Some operators have already built strong driver-engagement programs and will
recognize a lot of what follows. For those who haven’t, my experience is that this is rarely a motivation problem. It’s more often a leadershipdesign problem. We can accidentally engineer drivers to be passive. Look at how the role is sometimes defined. The job description says: drive the truck safely, make all the stops, stay on schedule, avoid problems. Performance reviews focus on ontime performance, route completion, vehicle inspection reports, and complaints. None of that necessarily rewards observation, awareness, or initiative. Drivers can end up trained to execute rather than to notice. If there’s no explicit expectation that they grow accounts, no system to capture what they see, and no feedback loop that tells them their input matters, then it shouldn’t be a surprise when those things don’t happen. This is not unique to our industry. Gallup’s workplace research consistently identifies frontline-heavy industries (manufacturing, construction, healthcare, route-based service) as having among the lowest engagement rates of any sector, in large part because most companies’ communication, recognition, and feedback infrastructure was built for desk workers. Gallup’s meta-analyses also find that roughly 70 percent of the variance in team engagement is explained by the manager and the immediate work design, rather than by HR programs or compensation in isolation. The implication is straightforward: if drivers in a particular operation are disengaged, the lever is generally not a pizza party. The lever is how the role is designed and led. That body of research connects to something foundational. The Service-Profit Chain, first articulated by Heskett, Sasser, Schlesinger and colleagues in the Harvard Business Review in 1994 and refined ever since, established that profit and growth in a service business are driven by customer loyalty; loyalty is driven by satisfaction; satisfaction is driven by the value of the service delivered; and value is created by satisfied, productive frontline employees who feel ownership of the customer relationship. In a shredding or records-management company, Issue 2 SIGNAL 2026 9
that frontline is, in large part, your driver. Three Types of Drivers In the companies I’ve worked with, drivers tend to fall along a spectrum. At one end is the Bin Picker: completes the route, minimal interaction, transactional mindset. In the middle is the Professional Operator: friendly, takes pride in the work, delivers consistent service. At the other end is what I call the Route Consultant: knows the accounts on their route, protects relationships, spots opportunities, and treats the route as a personal business. Many companies have one or two Consultants who go there on their own. The strategic question is whether you can move drivers along that spectrum on purpose. I think the answer is yes, but it takes deliberate design across five components: clear expectations, simple conversation prompts, meaningful incentives, tracking and accountability, and recognition that builds identity. Component 1: Make Growth Part of the Job If it isn’t written down, it’s harder to make it stick. Adding customer awareness and opportunity identification to your driver job description, your onboarding materials, and your performance review template gives the role the clarity it needs. Some operators are surprised when they audit their current driver job description and find that it has not been meaningfully updated in years and contains little language about customers, growth, or observation. One useful frame is to organize the role around four pillars: safety, service quality, customer awareness, and identifying opportunities. The fourth pillar is the one that’s often underdeveloped. Telling a driver during onboarding that part of their job is to notice things and report them, and meaning it, gives them permission to engage in a way they may not have had before. Component 2: Give Drivers Simple Questions Drivers don’t need to sell. They just need to ask. One of the bigger mistakes operators can make when rolling out a driver-engagement program is trying to turn drivers into salespeople. Most drivers 10 SIGNAL 2026 Issue 2
don’t want that role, and most customers don’t want it either. What tends to work is teaching drivers four or five natural, low-pressure questions they can ask in the normal course of a service visit. In the field, that might sound like: “Are you still happy with your service schedule?” “I noticed extra boxes by the bin. Are you doing a clean out?” “Is there anything else we can help with? I can have someone from our office reach out.” “Do you know anyone else in the building who might benefit from our services?” One important guardrail: The goal of these questions is to surface a lead, not to scope or close work in the field. Drivers should hand any expansion-of-service inquiry back to your sales or customer service team for proper intake and follow-up. The driver opens the door. The office walks the customer through it. That keeps things clean for the customer, the driver, and the operator. Friendly. Natural. Helpful. Not salesy. The questions can go on a laminated card and get role-played in the morning huddle. The bar is not eloquence. It’s consistency. A driver who asks one of these questions on every fifth stop will, by sheer volume, surface more opportunities in a month than the sales team is likely to find in a quarter.
Component 3: Use Meaningful Incentives Pizza parties don’t change behavior in a sustained way. Neither do small spiffs and one-time bonuses. The behavioral economics here are well established and practical experience in our industry tends to confirm it: incentives that are too small, too occasional, or too disconnected from the action they’re meant to reward usually get filed under “nice gesture” and forgotten. What tends to work is a referral bonus large enough to matter. Many operators in our industry land in the $250 to $500 range per closed account in shredding and records management, paid quickly, paid publicly, and tied to a clear, simple rule. Some operators add a revenue-participation component for ongoing accounts. Whatever structure you choose, a useful test is this: Would a driver tell their spouse about it? If the answer is no, the incentive may not be big enough. It can help to pair the referral bonus with a broader driver scorecard that captures the full picture of the role: safety (vehicle inspection reports, violations), service (on-time stops, accuracy), professionalism (uniform, training), customer experience (feedback), and reliability (attendance). Tier the bonus, for example: top tier for scores of 90 to 100, strong bonus for 75 to 89, moderate for 50 to 74, and none below 50. Drivers earn bonuses based on observed behavior rather than guesswork, and the structure tells them clearly what “winning” looks like.
Visibility is half the battle. The other half is closure. Few things kill a driver-engagement program faster than a driver flagging an opportunity that disappears into a black hole. Build a clear handoff process between drivers and the sales team, ideally a same-day acknowledgment and a 48-hour first-contact commitment. When drivers see their leads turning into closed deals (and bonus checks), the behavior compounds. Component 5: Recognition Changes Identity Drivers want what most employees want: respect, ownership, and visibility. One of the more underrated levers in any driver program is public recognition for the right behaviors. Celebrate the new account a driver brought in. Celebrate the atrisk customer they saved. Celebrate the renovation they spotted that turned into an expansion contract. Read the stories aloud. Put the names on the wall. This matters because of how identity drives behavior. There’s a meaningful difference between someone who says “I’m just a driver” and someone who says “I manage this route.” The second statement reflects ownership, accountability, and pride. It also reflects how that person is likely to behave on stop number 67 of the day, when they’re tired, behind schedule, and they notice that the customer’s lobby looks different than it did last month. The first person keeps driving. The second person asks a question. People don’t rise to incentives. They rise to expectations.
Component 4: Track What You Want to Repeat What gets measured tends to get repeated. Many CRMs in our industry are built primarily for outbound sales activity rather than inbound driver intelligence. A simple fix is to add a single category, such as “Driver Referral,” and track three things per driver: leads generated, accounts closed, and revenue created. A monthly leaderboard in the dispatch office and recognition at the morning huddle go a long way. Issue 2 SIGNAL 2026 11
Training: How to Roll This Out Designing the system is the easier part. Keeping it from dying on the vine during implementation is harder. Five steps tend to make the difference. First, explain the why. People generally don’t buy into what they don’t understand. Tell drivers, explicitly, why this matters to the company, why it matters to them personally, and how it connects to the growth and stability of their job. Frame it as professional development, not as sales pressure. Second, show what it looks like. Don’t just tell them. Demonstrate the conversations. Roleplay the questions. Have a senior driver or operations manager model the behavior on a ride-along. Many drivers haven’t seen this done well; they need a picture. Third, make it safe to try. The fear of “messing it up” is what keeps many drivers silent. Make it explicit that you don’t expect perfection. You expect attempts. The driver who tries an awkward question and comes back with a referral has done the right thing, even if the delivery was clumsy. Confidence drives behavior. Fourth, reinforce weekly. What gets repeated tends to become a habit. Build the conversation into your weekly driver meeting. Spend ten minutes every week reviewing what people heard, saw, and asked. Coach in small doses and do it consistently rather than only at quarterly or annual reviews. Fifth, celebrate behavior, not just results. Behavior precedes results. Recognize the attempt before you can recognize the outcome. A driver who asked five questions this week and got zero referrals deserves the same coaching attention as the driver who happened to land a big purge job. Behavior is the leading indicator. Reward what you want more of. The Numbers, Put Together Run the math for your own business. Take 12 SIGNAL 2026 Issue 2
a modest illustrative example: ten drivers, each generating one referral that closes per month, with an average new-account value of $150 per month in recurring revenue. That’s 120 new accounts per year, generating $216,000 in new annual recurring revenue from the same trucks, the same drivers, and the same routes. EBITDA multiples in our subsector vary widely by sub-vertical (records storage typically commands higher multiples than mobile shredding), revenue quality, customer concentration, geography, and broader market conditions. Even at a conservative multiple, recurring revenue of this kind can produce meaningful incremental enterprise value over time, without adding a truck, a route, or a salesperson. Even at half that pace (one referral per driver every two months), the underlying ARR contribution remains material. The leverage is significant because customer interactions are already happening. You’re paying for them anyway. The question is whether you’re extracting any commercial intelligence from them. Common Mistakes to Avoid A few traps to sidestep. Trying to turn drivers into aggressive salespeople tends to backfire with drivers and customers alike. Underinvesting in the sales-team handoff is demoralizing for drivers; nothing kills momentum faster than a lead that goes nowhere. Paying incentives without recognition leaves a lot of value on the table, since the public acknowledgment is often what changes behavior, more so than the bonus itself. And launching this as a one-time campaign and then abandoning it is a common failure mode. The companies that get sustained results are the ones that make this part of their operating rhythm: every week, every quarter, every year. One Last Story A few months after I started building this kind of program at our company, one of our drivers (I’ll call him Mike) came back from a route and mentioned, almost in passing, that one of his customers had been stacking boxes next to the shred bin for two weeks. He said it looked like they were cleaning out a storage room. We followed through our normal sales process. It turned into one of the largest purge projects we did that year.
When I thanked Mike, his answer was the thing that has stuck with me: “I figured it was my job to look out for the account.”
References & Further Reading
That, to me, is the difference. Not training. Not technology. Not compensation, on its own. Identity. Mike believed it was his job to look out for the account because we had, finally, designed his role and led him in a way that made that belief reasonable. The opportunity in your business probably isn’t whether your drivers can do this. They can. The opportunity is whether you’ve built the system that lets them.
Reichheld, F. F., & Sasser, W. E. (1990). “Zero Defections: Quality Comes to Services.” Harvard Business Review, September–October 1990.
Drivers can be a cost center or a growth engine. The difference often isn’t who you hired. It’s how you lead them.
Heskett, J. L., Jones, T. O., Loveman, G. W., Sasser, W. E., & Schlesinger, L. A. (1994). “Putting the Service-Profit Chain to Work.” Harvard Business Review (reissued 2008).
A U T H OR Jeff Green
Reichheld, F. F. (2001). Loyalty Rules! How Today’s Leaders Build Lasting Relationships. Harvard Business School Press. See also Bain & Company, “Prescription for Cutting Costs: Loyal Relationships.”
Heskett, J. L., Sasser, W. E., & Schlesinger, L. A. (1997). The Service Profit Chain: How Leading Companies Link Profit and Growth to Loyalty, Satisfaction, and Value. The Free Press. Schmitt, P., Skiera, B., & Van den Bulte, C. (2011). “Referral Programs and Customer Value.” Journal of Marketing, 75(1), 46–59.
About the Author Jeff Green is Vice President, Business Development at Annex, a marketplace where businesses can shop and book secure document storage and destruction services online. He is a long-time operator in the secure informationmanagement industry and a regular speaker at the i-SIGMA Conference, working with shredding, records-management, and ITAD businesses on operational design, sales-and-service alignment, and frontline leadership.
Gallup. State of the Global Workplace Report. Gallup, Inc. (most recent edition). Gallup. Q12 Meta-Analysis: The Relationship Between Engagement at Work and Organizational Outcomes. Gallup, Inc. Harvard Business Review (2014). “The Value of Keeping the Right Customers.” Amy Gallo. American Trucking Associations. Driver turnover and retention industry data. i-SIGMA. NAID AAA Certification standards and CSDS curriculum materials, available at isigmaonline.org.
Issue 2 SIGNAL 2026 13
Inside the Buyer’s Mind and Preparing Your Exit Strategy Jim Teske
Are you planning for the sale of your business? If the answer is yes, then you’re on the right track. You’re planning ahead…whether your timeframe is in 3 months, 3 years or even farther down the road. If you’re not planning for a sale… why not? There is one fundamental truth to consider. It likely isn’t a matter of IF you plan on selling but WHEN you plan on selling. I was very fortunate early in my career to work for a couple of Stanford MBA’s that were very smart, had great teachers/advisors and who applied some fundamental principles at First American Records Management back in the 1980’s and 1990’s including “what gets measured gets done” and “plan your work, work your plan.” Long term planning for a business sale is not completely dissimilar to selling a house or a car…just a whole lot bigger. Selling a document storage, information destruction or imaging/ electronic content management (ecm) operation is typically a once in a lifetime event. You always want your business to be something someone else wants to buy…so plan ahead. Predictable Recurring Revenue and Profitability Four decades ago when I first starting running document storage operations (before secure shredding even became an “industry”), customer file boxes sitting on the shelf largely involved 14 SIGNAL 2026 Issue 2
one initial sale to that customer; with monthly revenues that roll over month after month and year after year. Such residual recurring revenue is a magical thing and still to this day remains what buyers value most. Buyers will look to P&L’s, invoice registers and service summaries and other metrics in measuring revenue reoccurrence across all customers, with key customers and within revenue categories; along with recurring expenses and profitability. In everything you do, look as much as possible to maximize your recurring revenue. Ancillary services, project work, sales of paper to a recycler or certain products sales of course have value, however they can be harder to predict…and predictability is key to a buyer. Customers Here’s a critical concept about your customers when it comes to a business sale: contracts and the revenue stream associated with those customer contracts are the primary asset you are selling. I am continually amazed by those that give it less focus nor the appreciation it deserves. I’ve heard it all before: “it’s just easier without contracts…I don’t need them”; “it speeds up the process as compared to having a contract that has to go through legal” or “my customers know me and trust me.” While all of that may be true, without traditional limitations
of liability a business owner is creating significant risk should an unfortunate event like a data breach or unauthorized disclosure occur. And further, customers don’t know the eventual buyer and again the buyer doesn’t want unnecessary risk. Having signed contracts reduce risks for both parties. You should have written and signed paperwork with every customer and most assuredly with your top 25 to 50 customers. Either deal with it from the start and put rates for your services along with traditional industry terms and conditions in place upfront or deal with it when you’re looking to sell. Contracts should have standard industry limitations of liability, should include language that is either silent on “assignment” or ideally that has language permitting the company (not customer) to assign the contract and should also include the length of the initial term and renewal terms. Renewal provisions (evergreen language) are important because neither you nor a buyer wants a contract to expire without being formally terminated or assigned. When it comes to revenue spread, your largest 5-10 customers as a percentage of total revenues will be another variable that buyers evaluate. Having a high percentage of revenues tied to any one customer or to a small group of customers increases perceived risks to a buyer. Buyers will look at the revenues by service category… storage vs services (including removals/ destructions) in the storage segment; scheduled services vs projects and recycling in the shredding/destruction segment; and recurring services like hosting, software licensing and workflow versus just scanning in the ECM segment. People Your employees can also be something that buyers look at pretty carefully. Negatives to a buyer include nepotism (a risk if one member of a family doesn’t work out), a lack of drug policies or enforcement (where accidents or risks can impact reputation, can present insurance issues or even the ability for drivers to get behind the wheel when
services in the field are time sensitive), having untrained staff, and/or a lack of discipline or lack of a service culture. In addition, unclean facilities or work environments can say a lot about either the leadership of the business or the people working there. And speaking of leadership, rewarding key leaders may be well earned in an owner’s view, however overpaid leadership can represent additional perceived risk to a buyer (as could over-reliance on the owner themselves). In contrast, opposites of the above can be considered positives or at least minimize perceived risks to a buyer including the lack of reliance on the owner, experienced leadership with reasonable compensation, appropriate hiring and cross-training practices, regular performance reviews and/or disciplinary policies and fundamentally having a team and people that like what they do and exemplify a service culture with company pride. Real Estate If you own your building(s) and you’ve underpriced your rental rate because you’re the tenant, then know that increases to get to “market rate” based on post-Closing periods likely impacts a buyer’s expected EBITDA. Consider this over time along with the tax implications of how rent versus purchase price impacts your sale. Issue 2 SIGNAL 2026 15
a purchase…which could be especially critical in the secure destruction segment with mobile shred trucks. Generally speaking, there is no extra purchase price for newer vehicles but there could be a potential adjustment if replacement is required. Lastly, for warehouse equipment and office furnishings, all assets used to serve customers are included (but in a PUMV may be less critical to Buyer). While an owner’s personal furniture or passenger vehicle are easy carve outs, other exclusions should not be expected (but might possibly be negotiated with the right buyer…most commonly in a PUMV situation). When it comes to the timing of a sale, don’t wait until after a new rollover term becomes effective or where there simply isn’t enough time leading up to closing (or post-closing) for the buyer to have options. Buyers like flexibility. If you own your space and want a buyer as a tenant, there are more variables to consider. The most profitable approach for a buyer could include what can be called a PUMV (pick-up and move); where the buyer has available real estate and can tuck your operations into theirs. That may or may not result in additional potential purchase price and your building may or may not be as valuable to the buyer compared to other potential renters in your area. Equipment All assets used in providing services to customers will be considered acquired assets of the buyer (based on a purchase price calculated as multiples of earnings or revenues) and no separate calculation is added for equipment valuation. The seller should assure shelving was installed to code and this is especially critical in an environment where the buyer will remain as a tenant. In a PUMV, the buyer may or may not want shelving. Consider the age and maintenance programs for your vehicles and how a buyer might look at vehicles in conjunction with 16 SIGNAL 2026 Issue 2
Buyer Efficiencies, Business Systems and Your Brand Purchase prices to some extent are based on YOUR profitability (not always what a buyer can achieve through their own efficiencies on real estate, leadership, staffing or overhead). The buyer’s proforma can of course make a business more attractive…and yes, buyers have to be competitive when they want any given deal. Stay focused on your own profitability since “owner add backs” are somewhat standard; getting credit for buyer efficiencies is not. When it comes to business systems, protecting customer and business data is who we are in this industry. What tools do you have to manage the business and how do you protect your business systems (and protect customer data) from either hacking or potential violations? Having recognized systems like O’Neil, DHS, Andrews, DocuData, EZ Shred as examples (sorry if I missed anyone) can matter to a buyer because clean data, that is easy to format and migrate for integration in their systems matters. While every buyer should ideally have a good story to tell acquired customers about their business, buying happy customers matters. It also assures that people joining the buyer’s team have a sense pride of where they work and that they care about delivering on expectations. Having issues with employees that don’t care hurts the buyer…employees are often interviewed or prehired and challenges with your team can impact a Closing.
Summary
Counselors and Advisors It’s a bit selfish of me to talk about brokers because I recently “switched sides” from representing a very active buyer over the last decade to now representing sellers in transactions. However brokers can play a valuable role over a measurable period leading up to a transaction in prepping the business. They can play a key role in bringing the right buyers (and maybe even lesser known buyers) into the process and play a role as a trusted and experienced advisor on literally everything involved in the transaction process. A great broker finds the things that will come up in negotiations and diligence and absolutely should earn their fees (and then some). When it comes to attorneys, legal counsel should primarily review and fine tune any binding agreements plus help with disclosure schedules and ancillary closing documents. Having an experienced deal-making transaction attorney matters; as compared to using a friend that may be a great litigator or family law attorney. And lastly, buyers will rightfully get frustrated if the attorney wants to start renegotiating deal points already agreed to within a Letter of Intent. Lastly when it comes to financial advisors, your CPA can play a role in helping you understand the financial implications of a sale including asset allocations and tax implications. However again, having someone that truly understands tax law and has a history of asset allocations can be highly valuable; as I have personal experience working with sellers (from the buyside perspective) where their CPA gave advice on allocations that unnecessarily could have cost them a lot of money based on how they placed assets into certain tax classes.
When you go to market, be honest and disclose what you’re selling. Details come up in duediligence, and you don’t want a buyer to find problems once you have a signed Letter of Intent (LOI). You don’t want surprises after signing an LOI and neither does the buyer. Buyers want predictable revenues, producing predictable earnings and minimized risks. Anticipate and address issues pre-sale based on a buyer’s perceived concerns about risk. This information comes from my experience and is offered for your consideration. I am not an attorney, accountant nor should this article be expected to necessarily apply to every situation, individual business or operation. My primary goal is to help as many of my peers as possible in preparing their business for eventual sale, to know a bit more about what is most important to buyers and for owners to know how to avoid common pitfalls and maximize value. Plan your work and work your plan! Jim Teske J.F. Teske Advisory Services, LLC www.jfteske.com About the Author Jim formerly served as Senior Vice President of Acquisitions for VRC Companies, LLC over the last decade and is a forty-plus year industry veteran. He can be reached at jim@jfteske.com. A U THO R Jim Teske J.F. Teske Advisory Services, LLC
Issue 2 SIGNAL 2026 17
Turn Cyber Risk Into Opportunity: What to Know About Putting Cybersecurity Into Place.
Karen Lyons, CSDS
Regulatory Compliance Manager Think about all the information that lives in your business and on your networks: details about your products and services, financial records, marketing plans, and customer information. If that information were exposed, the consequences could extend far beyond inconvenience. There could be regulatory implications, reputational damage, contractual fallout, and loss of customer trust. This is why i-SIGMA has developed certification specifications that act as practical safety nets for you, our members, strengthening your defenses, showing the general public that cybersecurity is built into your operations, a proactive investment in member credibility, resilience and long-term market strength. While the cybersecurity implementations below may seem like enhancements to PRISM Privacy+, they are a welcome new addition to NAID AAA. Cybersecurity implementation applies to both NAID AAA and PRISM Privacy + Certifications as of 1 October, 2026 Members are now required to have cybersecurity policies and/or procedures(s), including acceptable use of servers and/or products, password management, and incident response. In practice, that means having clear written rules that define how employees use company systems, how passwords are created and 18 SIGNAL 2026 Issue 2
protected, how incidents are reported, and how access to systems is controlled. For example, any non-company device that an employee connects to your network can become a major point of vulnerability if it is not governed by policy. Incident response is already a certification requirement, and your organization should ensure employees understand exactly what to do when suspicious activity is identified. Be sure to include your cybersecurity protocols in their annual signed agreements of your organization’s policies and procedures.
Infrastructure Security Agency (CISA), a U.S. federal agency under the Department of Homeland Security offering a range of no-cost CISA-provided cybersecurity services, and CODE.NSA.GOV (NSA’s Open Source software site that makes NSA-developed software available to the public for use). For some government-related contracts, cybersecurity expectations may also align with frameworks such as NIST SP 800-171 and CMMC 2.0, which are used to verify whether organizations can protect sensitive information in nonfederal systems.
In addition to physical, logical and administrative controls, certified members will now be asked to implement policies to prevent unauthorized physical access to servers, storage devices, and network equipment. This may include locked server rooms, restricted key or badge access, secure storage for backup media, and network equipment including who may enter sensitive areas and when. Be sure to amend your policies, procedures, and training materials with this new enhancement.
Implementing the security risk analysis demonstrates to your customers that access is limited, threats are detected earlier, known vulnerabilities are patched, and essential protections are consistently applied across the environment.
The third-party network security verification requirement has been expanded to include an annual Security Risk Analysis. In practice this requirement calls for an annual comprehensive security risk analysis performed by a qualified third party to verify that core network security controls are in place. The analysis should include evidence of the following: • Enforcement of least-privilege principles • Multi-factor authentication • Antivirus software • Firewall • Endpoint detection tools across all devices • Patch management Examples of qualified third party support may include an external cybersecurity firm, an internal risk assessment led by competent security personnel, or a formal assessment aligned to a recognized framework. No or lowcost options include the Cybersecurity and Issue 2 SIGNAL 2026 19
What NAID AAA overwriting providers should know NAID AAA certified operations who provide overwriting services should have policies and procedures and physical infrastructure effectively preventing unauthorized access to servers and local workstations to trained and approved Access Individuals. In practice, this means workstation and server access is limited to trained and authorized Access Individuals through documented policies, procedures, and physical protections that prevent unauthorized use Lastly Overwriting providers are now asked to implement policies and procedures to describe its Identity and Access Management (IAM) and Control methodology approach for all Access Individuals. This description should clearly explain who approves access, how
20 SIGNAL 2026 Issue 2
permissions are limited by role, how changes are recorded, and how access is reviewed or removed when responsibilities change. It should also include language specifying the training of Access Individuals on the proper use of imaging/digitization equipment, documenting the completion of such training. This may include how access is assigned, controlled, managed, and reviewed so that only authorized personnel can use systems and resources. Training documentation is important because it demonstrates that access is not only granted, but supported by clear instruction, consistent expectations, and a record of completion. Why Now? Digital security is every bit as important as physical security. These controls reflect the types of safeguards customers increasingly expect to see from trusted service providers. Implementation greatly increases a competitive advantage over
providers who don’t yet have digital security controls. This is about more than passing an audit. Many customers want to see a commitment backed by official certification, especially when vendor due diligence is becoming more rigorous. When certified members can show that their cybersecurity practices are documented, enforced, and independently validated, customer confidence grows—and so does the value of certification. In many markets, that level of assurance matters more than ever.
A UTHO R Karen Lyons, CSDS
Issue 2 SIGNAL 2026 21
SOC 2 vs. NAID AAA: Understanding the Differences i-SIGMA Certification Team
Executive Summary SOC 2 and NAID AAA are widely recognized assurance frameworks, but they validate fundamentally different risk domains. SOC 2 focuses on cybersecurity, privacy, and organizational controls. NAID AAA focuses on secure data destruction operations, chain-ofcustody controls, and destruction verification. Organizations that handle sensitive data or manage data destruction operations frequently encounter two distinct compliance frameworks: SOC 2 and NAID AAA. While both signal trustworthiness and a commitment to security, they serve very different purposes, industries, and audiences. Understanding the distinction is important for compliance professionals, procurement teams, IT leaders, and service providers seeking to demonstrate appropriate controls to clients and stakeholders. This article examines each framework, compares their scope and structure, and explains when one—or both—may be appropriate.
technology and cloud-based organizations, including SaaS companies, cloud service providers, managed service providers (MSPs), and any business that stores, processes, or transmits customer data through software systems. SOC 2 is built on the Trust Services Criteria (TSC), which organizes security and privacy expectations into five categories: •
Security — Protection against unauthorized access. This is the only required category and forms the foundation of every SOC 2 engagement.
•
Availability — Systems are available for operation and use as agreed upon with customers.
•
Processing Integrity — System processing is complete, accurate, timely, and authorized.
•
Confidentiality — Information designated as confidential is protected appropriately throughout its lifecycle.
•
Privacy — Personal information is collected, used, retained, and disclosed in accordance with stated policies.
What Is SOC 2?
SOC 2 Report Types
SOC 2 (System and Organization Controls 2) is a compliance framework developed and governed by the American Institute of Certified Public Accountants (AICPA). It is designed for
SOC 2 engagements result in one of two report types:
22 SIGNAL 2026 Issue 2
Type I evaluates whether controls are suitably designed as of a specific point in time.
Type II examines a defined period—typically six to twelve months—and tests whether controls operated effectively throughout that period. Type II is widely considered the industry benchmark and is the report most enterprise customers require.
•
Physical Security — Access controls, surveillance systems, secure facilities, and locked transport containers.
•
Key Point: SOC 2 audits are conducted exclusively by licensed CPA firms. The resulting deliverable is a report, not a certification.
Employee Screening — Background checks, confidentiality agreements, and security awareness training.
•
Destruction Equipment Standards — Requirements for destruction technologies appropriate to specific media types, including paper, hard drives, optical media, and solidstate devices.
•
Destruction Verification — Issuance of Certificates of Destruction as documented proof of compliance.
What Is NAID AAA? NAID AAA Certification is governed by i-SIGMA (formerly the National Association for Information Destruction) and is designed specifically for organizations operating in the data destruction industry. This includes document shredding providers, IT asset disposition (ITAD) companies, hard drive destruction firms, electronics recyclers, and related service providers. While SOC 2 focuses primarily on digital and cybersecurity controls, NAID AAA concentrates on the operational standards required for the secure destruction of sensitive information and media. This includes both physical destruction methods—such as shredding and degaussing— and non-physical methods such as certified data erasure. Certification focuses on five core areas: •
Chain-of-Custody Controls — Secure, documented, and auditable handling of materials from client pickup through final destruction.
NAID AAA Audit Structure NAID AAA follows a three-part oversight model. Certified companies submit an annual renewal application. In addition, a scheduled audit is conducted every other year by an independent third-party auditor. Beyond those planned reviews, unannounced audits may occur at any time, requiring organizations to maintain compliance continuously rather than preparing only for a scheduled audit event. The outcome is a certification indicating compliance with NAID AAA operational standards rather than a narrative audit report. NAID AAA audits are performed by independent third-party Certified Protection Professionals (CPPs) credentialed by ASIS International.
Side-by-Side Comparison Area
SOC 2
i-SIGMA’s NAID AAA Certification
Scope
Organization-wide security & privacy controls
Data destruction operations
Industry
SaaS, cloud, tech, MSPs
Shredding, ITAD, e-waste
Audit Style
CPA audit
Annual renewal, biennial scheduled audit, unannounced audits
Output
Type I or Type II report
Certification
Focus
Cybersecurity, governance, risk management
Destruction operations and chain-of-custody
Governing Body
AICPA
i‑SIGMA Issue 2 SIGNAL 2026 23
Which One Do You Need? The right answer depends entirely on the nature of your organization’s work. These frameworks operate in different risk domains and are not interchangeable. •
If your organization is a software, cloud, or managed services company that processes customer data through digital systems, SOC 2 is generally the relevant framework.
•
If your organization is a data destruction or ITAD company responsible for secure collection, transport, destruction, or certified erasure of media, NAID AAA is generally the relevant certification.
•
Some organizations—particularly ITAD companies offering client-facing software platforms—may benefit from maintaining both frameworks.
Key Takeaways •
SOC 2 is the leading assurance framework for digital data handlers.
•
NAID AAA is the leading certification program for data destruction providers.
•
The audit structures are fundamentally different.
•
The outputs are different: report versus certification.
•
Some organizations may benefit from holding both.
For informational purposes only. Consult qualified compliance advisors, CPA firms, or i‑SIGMA-accredited resources regarding specific requirements. About the Authors Karen Lyons, CSDS Regulatory Compliance Manager Shaina Van Kilsdonk Certification Associate Victoria Vale Certification Associate
CASH for your SCRAP FILM
EXPIRED FILM = WASTED SPACE SCRAP FILM = $$CASH$$ HIPPA COMPLIANT ENVIRONMENTALLY FRIENDLY CRE also offers Safe & Reliable Destruction of Film and All Associated Records (also Hard Drives, Cassettes, Video Tape and Medicine Bottles)
Give CRE a Call Today: 1-800-943-2811 or online at: www.creweb.com 24 SIGNAL 2026 Issue 2
7 2 , 0 o 2 , d 6 n a l 4 r l i O r , p t g t A r o i o . r f r n a o c M a W m J .isig w w w
30 SIGNAL 2026 Issue 2
e d n Gra
s e k La
member news Armstrong Archives Announces Ownership Transition as Sherri Taylor Buys Out Partners DALLAS, TX- Armstrong Archives, an i-SIGMA Member Company and a trusted North Texas records management company, announces an important ownership transition as CEO Sherri Taylor has bought out her business partners and become the sole owner of Armstrong Archives, formerly a subsidiary of the Armstrong Company, a full service global moving company. The transition represents the next phase of growth while maintaining the leadership values, company culture, and client-focused approach the company has prioritized for three decades. Taylor, who founded the company 30 years ago, has run day-to-day operations from the very beginning. As part of the transition, Trent Davis has been promoted to President, a role that he moves into from within the company. Davis will continue to work alongside Taylor and the rest of Armstrong Archives’ leadership team which remains unchanged following the buyout. Armstrong Archives also refreshed their brand – while their look has evolved, their commitment remains the same: delivering secure, reliable, and personalized record management solutions backed by exceptional client service. The buyout and refreshed branding position Armstrong Archives for future growth to meet client needs across North Texas. Armstrong continues to invest in equipment, facilities and infrastructure, refine internal processes, leverage new technology, and invest in training and development of their team. This new chapter reflects Armstrong Archives’ commitment to honoring its history while investing in the future of records management.
26 SIGNAL 2026 Issue 2
About Armstrong Archives For 30 years, and locally-owned and operated, Armstrong Archives is a secured document management company based in Carrollton, proudly serving businesses across North Texas. They provide protected, efficient document storage and records management, with personalized solutions tailored to business needs. For more information, visit https:// www.armstrongarchives.com/, or contact Sherri Taylor at staylor@aarchives.com.
Shred America/Carolina Shred Announces Acquisition of Major Shreds, LLC in Orangeburg, South Carolina FOR IMMEDIATE RELEASE [Fort Mill, South Carolina] — Shred America / Carolina Shred is pleased to announce the acquisition of Major Shreds, LLC, a secure document destruction company based in Orangeburg, South Carolina. The acquisition became effective June 30, 2026. The acquisition further expands Shred America / Carolina Shred’s footprint throughout the Southeast while strengthening its ability to provide secure shredding and information destruction services nationwide. Founded in South Carolina, Shred America / Carolina Shred has become the nation’s fastest growing provider of secure document destruction, hard drive destruction, records storage, and compliance-based information security services. Through its national service platform, the company provides secure service solutions to customers across the United States. Customers of Major Shreds will continue to receive uninterrupted service and support throughout the transition process.
Will Reynolds, owner of Major Shreds, LLC “We are proud of the business and customer relationships we have built over the years. Joining forces with Shred America / Carolina Shred allows our customers to benefit from expanded resources, additional service offerings, and nationwide coverage while continuing to receive the local service they trust.” Ryan Richard, CEO of Shred America “We are excited to welcome Major Shreds into the Shred America family. Their strong reputation, loyal customer base, and commitment to service align perfectly with our company values and long-term growth strategy.”
Advertise in the
iG Journal
Ray Barry, President of Shred America
“This acquisition represents another important step in our continued growth strategy across the Southeast Contact Our i-SIGMA to place your and nationally. goal istoday to continue providing ad in the next issue. industry-leading customer service, NAID AAA Certified security standards, and scalable advertising@isigmaonline.orgnationwide solutions for organizations of all sizes.”
Take Advantage of Your Member Resources As an i-SIGMA member representative, you can access exclusive members’ only educational content and marketing resources, update your membership information, and register for events. Login to the Member Portal and Visit My Digital Library for Exclusive Access to Resources. www.isigmaonline.org/membership/ member-portal/
About Shred America Shred America is the fastest-growing information destruction company in the United States, providing legendary brands combine secure,Three compliant, and reliable shredding services to businesses nationwide. With a veteran-owned to create an unmatched partner. leadership team and a commitment to operational excellence, Shred America delivers industry-leading service backed by a national network of trusted professionals. For media inquiries, please contact: Kiley Mattson Director of Marketing | Eastern Fleet Manager, Shred America Kiley@shredamerica.com | (337) 936-5841
Issue 2 SIGNAL 2026 27
association news SBA Proposal Could Reshape Small Business Contracting Eligibility By Gina Lentine, CSDS; i-SIGMA Vice President of Marketing & Events The Americas Advocacy group is actively monitoring upcoming changes at the SBA and wants to keep you informed. Learn more below: A proposed rule from the U.S. Small Business Administration (SBA) could significantly change how companies qualify as “small businesses” for federal contracting purposes. The proposal would revise size standards across hundreds of industries and could make more than 114,000 additional firms eligible for small business programs and set-aside opportunities. For i-SIGMA members that participate in federal contracting, subcontracting, or government-related projects, the proposal is worth a closer look. While the rule has generated both support and criticism within the contracting community, one thing is clear: organizations should understand how the changes could affect their NAICS classifications and competitive position before the public comment period closes on September 21, 2026. Start with Your NAICS Codes If your company is registered as a small business with the SBA, your first step should be reviewing the NAICS codes associated with your business. The SBA’s proposal would change how size standards are applied across many industries and would move toward broader industry classifications in numerous cases. Depending on your primary NAICS codes, the proposal could change whether your organization qualifies as a small business under SBA rules. For companies pursuing federal opportunities, size status affects much more than a registration record. It can influence contract eligibility, teaming arrangements, subcontracting opportunities, and participation in federal small business programs. 28 SIGNAL 2026 Issue 2
Potential Impact Will Vary The proposal has sparked considerable discussion throughout the federal contracting community. Supporters argue that existing size standards do not always reflect current market realities and can make it difficult for growing businesses to remain eligible for small business programs. Critics contend that expanding size standards could increase competition within setaside programs by allowing larger firms to compete alongside smaller businesses. Whether you view the proposal as an opportunity or a concern, the most practical step is to determine how the changes would affect your specific industry classifications and business operations. The Comment Deadline Is Approaching The proposed rule is currently open for public comment through September 21, 2026. The SBA is seeking input from businesses, industry organizations, and other stakeholders regarding both the proposed size standards and the methodology used to develop them. If your organization could be affected by these changes, now is the time to review the proposal and consider sharing feedback. Comments from businesses operating in the affected industries help provide the SBA with real-world perspectives on how the proposed standards may impact competition, growth, and access to federal opportunities. Learn More • • • •
Federal Register Proposed Rule: Small Business Size Standards [federalregister.gov] SBA Announcement on Proposed Changes [sba.gov] Federal News Network Coverage PR Newswire Release
A Personal Note to the Membership As many of you know, the end of September marked my last day with i-SIGMA. As I go, I wanted to share a few thoughts about the certifications and the future of the program. When I joined i-SIGMA, I came in as a thirty-plus-year industry veteran who already believed the certifications mattered. After working with the program every day for the last two years, I believe that even more. I’ve seen the work that goes into maintaining it, the challenges members face in meeting the requirements, and the value independent verification brings to customers and the marketplace. One thing I’ve become more convinced of is that the long-term strength of NAID AAA and PRISM Privacy+ is their role as operating frameworks, not just technical standards. Technical requirements, best practices, laws, regulations, and customer expectations are going to keep changing. What doesn’t change is the need for documented controls, trained employees, management oversight, accountability, corrective action, and independent verification. At their best, the certifications give members an operating model built around those principles while still leaving room to apply the technical standards and controls that make sense for their customers and markets. Those requirements may come from ISO, NIST, SOC, R2v3, customer expectations, or standards that have not even been written yet. The basic idea is still pretty simple: do what you say you’re doing and be ready to prove it. That approach has served this industry well for a long time, and I believe it will continue to do so after I leave. Technology will change. The regulations will change. The market will change. The need for trust, accountability, and independent verification will not. I want to thank the people who make the certification program possible. Certification only works because members are willing to submit themselves to independent oversight and accountability. That commitment is what gives the certifications their value and credibility in the marketplace. I also want to recognize the people behind the program. The i-SIGMA staff are among the most dedicated professionals I’ve worked with, and I’m grateful for their support, patience, and friendship. I’m especially thankful to Karen Lyons, Shaina Van Kilsdonk, and Victoria Vale, who carry a tremendous amount of the day-to-day work needed to keep the certification program moving forward and support our members. I’m also grateful to our auditors, whose professionalism, expertise, and independence remain central to the credibility of these certifications. I’m also grateful to Nate Campbell and the Board of Directors for their support of the certification program. Over the past two years, i-SIGMA has made real investments in strengthening certification requirements, improving cybersecurity expectations, sharpening audit oversight, and modernizing the technology behind the program. Not every change was easy, and not every change was welcomed by everyone, but the work has positioned the certifications well for the future. As part of that future, I’m pleased to welcome Kent Rodgers as i-SIGMA’s new Vice President of Certifications and wish him every success in the role. It has been a privilege to serve the association and its members. I am confident that the certification program is strong, relevant, and well positioned for what comes next, and I’ll be cheering for its continued success from the sidelines. Thanks for your trust, your support, and your commitment to protecting the integrity of our industry. Respectfully, W. Price Brannon Director of Certification i-SIGMA®
Issue 2 SIGNAL 2026 29
Issue 2 SIGNAL 2026 31
join the conversation Keep informed on industry news and network with peers on social media with i-SIGMA
Connect with us on LinkedIn i-SIGMA Follow us on X @i-SIGMA Like us on Facebook at i-SIGMA Subscribe to our YouTube Channel i-SIGMA 7 i-SIGMA Buyers’ Guide
Issue 2 SIGNAL 2026 25
WELCOME
NEW MEMBERS
New i-SIGMA Service Provider Members
welcome new members
Archiving and Data Solutions (PVT.) LIMITED in Karachi, PK Buffalo Computer Recycling in Buffalo, NY, USA Certified Waste Solutions Anaheim, CA, USA eLot ElectronicsService Recycling,Provider Inc in Glenmont, NY, USA New i-SIGMA Members ERecycle in Traverse City, MI, USA GreenTek Solutions Stafford, USA in Karachi, PK Archiving and Data Solutions (PVT.)TX, LIMITED Community Agency in Lancaster, OH, USA BuffaloLancaster-Fairfield Computer Recycling in Buffalo,Action NY, USA Maple LeafSolutions Shredding in BC, Canada Certified Waste Anaheim, CA, USA Patriot IT Solutions, AZ,USA USA eLot Electronics Recycling,LLC Inc in Scottsdale, Glenmont, NY, New i-SIGMA Service Provider Members Recycletech DBA Assetworx ERecycle in Traverse City, MI, USAin Springville, UT Secure Information Disposal Services Ltd in Fanling, N.T Hong Kong GreenTek Solutions Stafford, TX, USA Toronto Electronics Exchange, Inc. Toronto, ON USOH, USA Lancaster-Fairfield Community Action Agency in Lancaster, Envicare LLC - Cartersville, GA, MapleGreen Leaf Shredding in BC, Canada Electronics Solutions (Charlotte) Inc Patriot IT Solutions, LLC in Scottsdale, AZ, USA Monroe, NC, US NewDBA NAID AAAinCertified Members Recycletech Assetworx Springville, UT Juneau Shredding Services, LLC - Juneau, AK, US Secure Information Disposal Services Ltd in Fanling, N.TON, HongCA Kong Equip Recycling - Mississauga, 307 ShreddingExchange, LLC in Riverton, WY, USA Toronto Electronics Inc. Toronto, ON Absolute Mobile Shredding - Sioux City, IA, US Access CIG, LLC in Evansville, IN, USA AER Shredding LLC - Newark, NJ, US Gem Lifecycle Solutions in Dallas, TX, USA Virnich Solutions - St. Charles, IL, US Shredding in Charleston, WV, USA NewKnightHorst NAID AAA Certified Members Strategic Telecom Supply & Solutions LLC RDI, Inc of Chicago, IL, USA Richmond, VA, Inc. USSolution Shred-it, LLC a Stericycle 307 Shredding in Riverton, WY, USAin Morgantown, WV, USA Allied 360 Pty Ltd Wetherill Park, NSW, AU Access CIG, LLC in Evansville, IN,-USA ThinkTLS Gainesville, Gem Lifecycle Solutions in Dallas, TX, USAGA, US Security Shred LLC -WV, Ogden, UT, US KnightHorst Shredding in Charleston, USA John Fayard Moving & Warehouse, LLC RDI, Inc of Chicago, IL, USA Gulfport, MS, US Shred-it, a Stericycle Inc. Solution in Morgantown, WV, USA
EMI Imaging - Stuart, VA, US Critical Technology Services - Norcross, GA, US
Remota - Emeryville, CA, US KOEI Japan Co., Ltd - Yokohama, Kanagawa, JP North Cedar Recycling, LLC - Stanwood, IA, US Chapel Brook LLC - Rochester, NH, US Shred Doc, LLC - Little Rock, AR, US Far West Recycling Portland - Portland, OR, US SK Tes Australia Pty Ltd - Villawood, NSW, AU Monmouth Wire & Computer Recycling Tinton Falls, NJ, USA 4R Recycling Private Limited - Bengaluru, KA India Mender - Euless, TX, USA Angels LLC - Seattle, WA, USA Upstate IT LifeCycle - Spencerport, NY, USA Yesterday’s Business Computers, Inc. Hillsborough Township, NJ, USA Rare Recapture Corp - Dallas, TX, USA
New i-SIGMA Corporate Partners
New i-SIGMA Corporate Partner Members Propel Advantage in Oakland, MI, USA Blackbelt 360 - Plantation, FL, US Certus - Veenendaal, UT, NL New i-SIGMA Corporate Partners WipeOS - Eden Prairie, MN, US KnowledgeLake - St. Propel Advantage in Oakland, MI, USA Louis, MO, US
New NAID AAA Certified Members C.P.M. Recycling Services - Rockford, IL, USA Juneau Shredding Services, LLC - Juneau, AK, USA Terra Revival Solutions, LLC - Farmville, NC, USA Relectro LLC, A Sage Sustainable Electronics Company - Telford, PA, USA _________________________ Sage Sustainable Electronics 34 iG Journal 2025 PA, IssueUSA 2 Montgomeryville, Full Circle Electronics US, LLC Farmer’s Branch, TX, USA Archive Information Management, Inc. _________________________ Winston Salem, NC, USA 34 TDG, iG Journal Issue 2 Inc.2025 - Chantilly, VA, USA 32 SIGNAL 2026 Issue 2
ThinkTLS - Gainesville, GA, USA Iron Mountain - Olathe, KS, USA Nugreen Metals LLC - San Antonio, TX, USA I-tad Technologies Solutions Inc Fort Worth, TX, USA Shred-it - a Stericycle, Inc. Solution Mount Pearl, NL Shred Safe, LLC - Marshfield, WI, USA Archive Data Solutions LLC - Westerville, OH, USA Rocycle North - Dade City, FL, USA
Advertise in the
Three legendary brands combine to create an unmatched partner.
Contact i-SIGMA today to place your ad in the next issue. advertising@isigmaonline.org
BEYOND THE EXPECTED
Issue 2 SIGNAL 2026 33
UPCOMING EVENTS International Summit November 4 - 6, 2026 Bangkok, Thailand
i-SIGMA Conference & Expo April 4–6, 2027 Orlando, Florida
For more details about i-SIGMA events, visit www.isigmaonline.org Want to place a classified ad for used equipment, trucks, or shelving and racking? The iG Insider™, the bimonthly e-newsletter for i-SIGMA, is the perfect outlet to spread the word. For $99, Service Provider Members may place an ad that will be seen by subscribers in the secure data destruction and records and information management industry. Your ad will contain an email link of your choice and an image of the item you are selling. Run the listing in additional issues for just $50 per issue. Contact advertising@isgimaonline.org. Remember, i-SIGMA not only reports the news about the secure data destruction and RIM industry, it makes the news. Contact media@isigmaonline.org.
34 SIGNAL 2026 Issue 2
ADVERTISER INDEX 3 Jake, Connor & Crew www.jakeconnorandcrew.com 4 Shred-Tech www.shred-tech.com 7 Vecoplan www.vecoplanllc.com 21 Bins4 Shredding www.bins4shredding.com 24 Commodity Resource Environmental Inc. www.creweb.com 33 American Baler www.americanbaler.com 33 KEITH Walking Floor www.keithwalkingfloor.com Inside back cover Downstream Data Coverage www.downstreamdata.com
You’re Covered, so They’re Covered Stop the cascading effects of data breach. Go beyond verbal assurances and show clients that your professional liability coverage protects not only you, but their firm too … even if you never need to use it.
Gain the confidence and resources to stand behind your commitments in a way that no one else in the market can. Professional liability coverage created for NAID AAA Certified companies www.downstreamdata.com 877-710-2498
Downstream Data Coverage protects against:
Negligence/Accidents Intentional Acts Client Data Breach Notification Costs Emergency Remediation Data Extortion
You’re Covered, so They’re Covered. Issue 2 SIGNAL 2026 35
P +1 602-788-6243 F 480-658-2088 info@isigmaonline.org 3030 N. Central Ave., Ste. 706 Phoenix, AZ 85012, USA The International Secure Information Governance & Management Association® (i-SIGMA®) is the industry trade association, enforcing standards and ethical compliance for approximately 2,500 secure data destruction and records and information management service providers on six continents. i-SIGMA currently maintains the most rigorous and widely accepted datasecurity vendor-compliance certifications, NAID AAA Certification® and PRISM Privacy+ Certification®, with hundreds of governments and thousands of private contracts using the programs to meet their regulatory due diligence requirements. Copyright © 2026, International Secure Information Governance and Management Association® (i-SIGMA®). All rights reserved. Reproduction in whole or in part without the express written permission of the International Secure Information Governance and Management Association is prohibited.
www.iSIGMAonline.org
36 SIGNAL 2026 Issue 2
Connect with us on LinkedIn i-SIGMA Follow us on X @i-SIGMA Like us on Facebook at i-SIGMA Subscribe to our YouTube Channel i-SIGMA