- Introduction
- Basic Security Principles
- Data Management: Determining and Maintaining Ownership
- Data Governance Policies
- Roles and Responsibilities
- Data Ownership
- Data Custodians
- Data Documentation and Organization
- Data Warehousing
- Data Mining
- Knowledge Management
- Data Standards
- Data Lifecycle Control
- Data Audits
- Data Storage and Archiving
- Data Security, Protection, Sharing, and Dissemination
- Privacy Impact Assessment
- Information Handling Requirements
- Record Retention and Destruction
- Data Remanence and Decommissioning
- Classifying Information and Supporting Asset Classification
This chapter is from the book
This chapter is from the book
This chapter is from the book
Data Governance Policies
Generally, you can think of policies as high-level documents developed by management to transmit the guiding strategy and philosophy of management to employees. A data governance policy is a documented set of specifications for the guarantee of approved management and control of an organization’s digital assets and information.
Data governance programs generally address the following types of data:
Sets of master data- Metadata
- Sensitive data
- Acquired data
Such specifications can involve directives for business process management (BPM) and enterprise risk planning (ERP), as well as security, data quality, and privacy. The goals of data governance include the following:
- Establish appropriate responsibility for the management of data
- Improve ease of access to data
- Ensure that once data is located, users have enough information about the data to interpret it correctly and consistently
- Improve the security of data, including confidentiality, integrity, and availability
Issues to consider include the following:
- Cost: This can include the cost of providing access to the data as well as the cost of protecting it.
- Ownership: This includes concerns about who owns the data or who might be a custodian. For example, you might be the custodian of 50 copies of Microsoft Windows Server 2019, yet the code is owned by Microsoft. Users pay for a software license and not ownership of the software itself, and they typically have only the compiled .exe file and not the source code for a program.
- Liability: This refers to the financial and legal costs an organization would bear if data were lost, stolen, or hacked.
- Sensitivity: This includes issues related to the sensitivity of data that should be protected against unwarranted disclosure (for example, Social Security numbers, date of birth, medical history information).
- Ensuring law/legal compliance: This includes items related to legal compliance. For example, you must retain tax records for a minimum number of years, but you might be required to retain personally identifiable information (PII) customer information for only the time it takes to process a single transaction.
- Process: This includes methods and tools used to transmit or modify data.