Skip to main content
green gradient background, "The Future of Application Security Is Already Here." and a read the report button.
Scan Now or Convert Later? Your Legacy Migration PathRecords Lifecycle
5 min readFor Records Managers

Scan Now or Convert Later? Your Legacy Migration Path

You're staring at three pallets of banker's boxes, a cabinet of microfilm reels, and a shared drive that hasn't been organized since 2009. Your ERP migration kicks off in six weeks. What gets scanned before cutover? What gets indexed after? What stays analog?

This isn't an IT decision. It's a compliance decision that'll determine whether you can answer an auditor's request eighteen months from now.

The Decision You're Facing

You need to choose how to handle legacy records during a system migration. Your options aren't "migrate everything" versus "migrate nothing." They're more nuanced: which records get full conversion treatment before go-live, which get basic inventory control, and which stay in their current format with updated tracking.

The wrong choice shows up when an auditor asks for a document and your new system returns nothing. By then, the box is in a warehouse you no longer lease, or the microfilm reel is unlabeled in storage, or the file exists but the metadata that makes it discoverable didn't transfer.

Key Factors That Affect Your Choice

Regulatory retention requirements. If a record series has a seven-year retention under your Records Control Schedule and you're three years into that period, you need four more years of audit-ready access. That requirement doesn't pause during a migration.

Litigation probability. Records subject to frequent Legal Holds need full-text search capability. If you can't keyword-search a document set, you can't respond to discovery efficiently.

Access frequency. A contract from 2018 that your legal team references monthly needs different treatment than a facilities invoice from 2012 that you're keeping only to satisfy a General Records Schedule.

Format complexity. A standard PDF transfers cleanly. A microfilm reel requires conversion equipment and quality control. A box of mixed paper needs sorting, scanning, and quality review. Budget your conversion resources accordingly.

Metadata completeness. If your legacy system has clean metadata (document type, date, department, retention code), you can migrate records with confidence. If it doesn't, you're building that metadata structure during migration, which changes your timeline and cost.

Path A: Full Conversion Before Cutover

Choose this when:

  • The record series is under active Legal Hold or has high litigation risk
  • You need full-text search across the entire dataset
  • The retention period extends more than two years past migration
  • Your auditors specifically require electronic access
  • The volume is manageable (under 50 banker's boxes or 20 microfilm reels per month of project time)

What it requires:

Scan or convert every item. Build complete metadata for every record. Validate that scans are readable and properly indexed. Test search functionality against known documents before you decommission the legacy system.

This path costs the most upfront but eliminates the compliance gap risk. When an auditor asks for a 2016 contract, your new system returns it in seconds.

Critical step: Run a pre-migration audit. Pull a random sample of 50 records from your inventory list. Physically locate each one. If you can't find all 50, your inventory isn't reliable enough to trust during conversion. Fix the inventory before you start scanning.

Path B: Inventory Control with Deferred Conversion

Choose this when:

  • The record series has low access frequency (less than quarterly)
  • Retention periods are short (under three years remaining)
  • You have reliable physical custody and can retrieve items on request
  • Full conversion cost exceeds the risk of maintaining dual systems
  • The records are paper-based and in stable storage conditions

What it requires:

Create or verify a complete inventory at the box or reel level. Assign unique identifiers. Update your Records Control Schedule to note the legacy location. Establish a process to convert items on-demand if they're requested.

This is the path for those facilities invoices from 2012. You know where they are, you can get them if an auditor asks, but you're not spending $2 per page to scan documents that'll probably reach disposition before anyone needs them.

Critical step: Document the retrieval process. Who has access to the storage facility? What's the SLA for pulling a box? How do you handle a Legal Hold that freezes records before you've converted them? Write it down now, because the person who knows won't be available when the auditor calls.

Path C: Controlled Disposition

Choose this when:

  • Records have reached their retention period
  • You have a valid Records Disposition Authority
  • No active Legal Holds apply
  • The cost of migration exceeds the remaining compliance value

What it requires:

Run a full disposition review before migration. Verify retention periods. Check for Legal Holds. Get sign-off from record owners. Execute disposition according to your authority.

Don't migrate records you're legally allowed to destroy. That's how you end up paying to store and search documents that should have been disposed of years ago.

Critical step: This isn't a shortcut around migration work. You still need the inventory, the Legal Hold check, and the disposition authority. But if records qualify, disposing of them before migration is often more defensible than migrating them and disposing of them later.

Summary Matrix

Factor Full Conversion Inventory + Deferred Disposition
Retention remaining >2 years <3 years Period expired
Access frequency Monthly or higher Quarterly or less None expected
Legal Hold risk High Low to moderate None (verified)
Search requirement Full-text needed Box-level acceptable N/A
Volume <50 boxes/month Any volume Any volume
Cost tolerance High Moderate Lowest

The compliance gap happens when you treat all legacy records the same. An unconverted microfilm reel isn't a problem if you know it exists, know where it is, and can convert it on 48-hour notice. It's a disaster if it's not on your inventory and an auditor asks for it.

Your migration plan should answer one question for every record series: "If an auditor requests this next year, can I produce it?" If the answer is yes, you've chosen the right path.

Promotional banner graphic asking if you are ready for PCI DSS 4.0 with a call-to-action to get the guide

You Might Also Like