Assign accountability
Governance roles distinguish business accountability from technical administration. Owners approve policy and use, stewards support definitions and quality, and custodians operate the systems that store and protect information.
- Document decision rights.
- Define quality expectations and escalation paths.
- Review access when roles or responsibilities change.
Protect data according to its sensitivity
Classification helps an organization apply appropriate access, handling, transmission, and disposal controls. Least privilege limits permissions, while masking or de-identification can reduce exposure in lower-trust environments.
- Grant access for an approved purpose.
- Avoid using production identifiers in ordinary testing.
- Monitor and review sensitive-data access.
Control the data lifecycle
Retention rules define how long records remain available and when they should be disposed of. Lineage supports traceability, while quality controls help ensure information remains fit for its intended use.
- Keep records for documented business or legal requirements.
- Dispose of data through approved methods.
- Trace important report fields back to their sources and transformations.
Quick Reference
Important Terms
- Data steward
- A role that supports shared definitions, quality expectations, and responsible use within a data area.
- Least privilege
- Limiting access to the minimum permissions necessary for an approved responsibility.
- Data lineage
- Traceable information about a data element's origin, movement, and transformation over time.
- Retention schedule
- A documented timetable specifying how long categories of records are kept and how they are disposed of.
- Data classification
- Grouping information by sensitivity, value, or handling requirements so suitable controls can be applied.
Original Public Practice
Check Your Understanding
1. A report developer can read only the approved reporting tables. Which principle is demonstrated?
Show answer and explanation
Answer: Least privilege.
The developer receives only the permissions required for the authorized task.
2. What helps an auditor trace a dashboard metric back through transformations to its source?
Show answer and explanation
Answer: Data lineage.
Lineage records origins, movement, and transformations that support traceability.
3. Which governance document determines when a category of records should be destroyed?
Show answer and explanation
Answer: A retention schedule or retention policy.
Retention requirements define approved storage periods and disposition actions.