What Is Data Governance?
Data Governance Definition
What is data governance? Data governance refers to a system that makes sure only authorized people can interact with specific data—while controlling what they can do, in which situation, and the methods they can use. An effective data governance framework maintains data integrity.
Several data governance components work together to accomplish what can be a complicated task. Organizations design each component to suit not just their goals but also the prevailing compliance standards in the jurisdictions affected by their data decisions. Further, data governance best practices ensure an organization has a controlled, well-organized data management system, and this paves the way for smooth digital transformations and upgrades.
Why Do Organizations Need to Govern Data?
Organizations need to govern data for the same reasons they need to govern their money. Like money, data is valuable. It can be stolen, and when used properly, it can play a key role in improving core systems.
Also, data lies at the center of organizational growth initiatives—but only if it is properly managed and leveraged. Otherwise, strategists, managers, and decision-makers would not be able to use it to make improvements.
The Role of Data Lineage in Data Governance
The concept of data lineage surrounds the path data takes as it moves from its source all the way through to its ultimate destination for consumption. When talking about data governance and working towards data governance best practices, it is critical to understand the role data lineage as a concept plays in that.
What is data governance and where does the linkage lie with data lineage? With data governance, you are focusing on the various processes, rules, and procedures an organization puts into play to manage data. Data lineage revolves around the movement of that data from its source to its destination.
The process of data lineage enables an opportunity for data stewards to document how data moves, where the authoritative source of that data lies, and how data is monitored from one point to the other.
Lower levels of data lineage can be data flow visualizations, which provide visual representations of how the data moves, where the business process fits, etc. Higher levels focus on overview details about data, their value, and monitoring of that same data. Data lineage is critical to helping govern data in an organization as it showcases data movement and enables control design and processes to monitor that data as it flows.
Data Governance Checklist
Data governance can be broken down into five basic components, which serve as the pillars for building a cohesive system. These include:
- Performing due diligence
- Building a data inventory
- Building controls
- Forming a data governance panel
- Providing accurate and clear notice regarding data governance policies
Components of a Data Governance Framework
A data governance framework is based on a system of actions upon which you build your data governance strategy. Here are its main components:
Perform Due Diligence
Due diligence involves checking who has access to what data and where the data is going. In many cases, this means taking a hard look at the vendors you partner with and the technology and policies they use as they interact with your data. If a vendor is noncompliant, you may need to work with them to address the issue. If they refuse to make adjustments, the relationship may have to end.
Build a Data Inventory
Also known as a record of authority, a data inventory identifies the personal data your organization collects, as well as where you keep it, how you protect it, and who has access to it. Key to your data inventory system is pinpointing the most sensitive data so you can establish controls that ensure its integrity and security.
Build Controls
To build controls, you need to design procedures and policies that define how people and systems use data, and this needs to be done for data moving both internally and externally. An important element of data management is controlling vendor access using principles of least privilege. They should only be allowed to interact with data they absolutely need to do their jobs.
Once the controls have been built, create a system that audits and tests their effectiveness. This way, you can make changes as needed.
Form a Data Governance Panel
Your data governance panel consists of people from different teams, such as the legal, IT, and marketing departments. These individuals make decisions regarding:
- How data will be accessed
- How access will be controlled
- How data access will support and impact business
Provide Accurate and Clear Notice Regarding Data Governance Policies
Once policies have been designed, make sure to give all stakeholders clear notice. Allow them to opt in or out of your governance system—as well as enough time to think it through.
Also, depending on the needs of your organization, your governance structure may change. Properly communicate any change with the right people, outlining how it will impact their jobs. This is particularly true for vendors, so they can decide whether they will participate.
On an internal level, you may have to invest time and resources training employees regarding how to implement your governance policies. This keeps everyone on board and accountable—an important part of the data governance system.
4 Critical Roles in Data Governance
A sound data governance framework is reliant on the definition of critical roles. Every organization will have unique paths they take in terms of governing big data. Their goals will vary, with different types of data structures as well as necessities. The four most common types of data governance roles are constant, and they include:
- Data administrator: The data admin is the individual that oversees the implementation of an entire data governance program. If there is any data-related conflict, the data administrator is the escalation point to resolve the conflict.
- Data steward: The data steward enables access to quality data for users across an organization. They bring together business and IT as a core function to enable critical data at accessible access points.
- Data custodian: The data custodian focuses on data in transit, as well as at storage points. Their job includes looking at the movement of data, storage of it, as well as security and use across the organization.
- Data user: The data user is any individual within an organization that makes use of accessible data to bring value forward.
Data Governance Initiative Inclusions
A data governance initiative should include data mapping and classification, and a business glossary. Data mapping and classification focuses on where and how data is used, as well as which categories it falls under. A business glossary consists of the language you use to talk about data.
Data Mapping and Classification
Although data mapping and classification are intricately linked, they involve different principles and action steps. Data mapping refers to how you connect one data field that exists in one source to a different data field that lives in another source.
How Data Mapping Works
Suppose you have a vendor charged with setting up an e-commerce portal that will process transactions for customers purchasing through your website. To create your system, the vendor’s team needs to gain access to the following customer data:
- Credit card information
- Names
- Addresses
- Phone numbers
- Email addresses
The mapping process involves answering two core questions:
- Where does that data currently live?
- Where will it live within your vendor’s system?
The answers to these questions are only the beginning. You also have to determine:
- The security risks involved in getting this data from point A to point B
- How to keep the data safe once it is inside your vendor’s system
- Other systems your vendor have that may have to interact with this data and how those systems are secured
- Will the vendor’s system be allowed to make changes to the data? If so, how can this potential vulnerability be mitigated?
How Data Classification Works
Data classification is typically more straightforward. Classifying data can be done using a few different classification categories, as well as a combination of several. For example, you have to classify data according to:
- Which government regulations apply to it, such as the Health Insurance Portability and Accountability Act (HIPAA)
- The data’s file type, such as .csv, .sql, or .log
- The kinds of risks it may be exposed to, such as data theft or tampering
Once data has been properly classified, it is easier to make decisions regarding where it can go, how it can be read once it gets there, and how to protect it throughout its lifecycle.
Data Governance vs. Data Privacy vs. Data Security
Data governance, privacy, and security all support data loss prevention (DLP) but are distinct concepts. Data governance provides the framework in which data privacy and security exist. In other words, data privacy and security are elements of a data governance system. The more nuanced differences are those between data privacy and security.
Data Privacy
Data privacy specifically deals with the people or systems you decide to share data with, as well as how it is collected. It also involves the methods you use to disseminate data as you transfer it across communication channels to other parties. This is because how you share data can impact whether or not it stays private.
For example, decisions around whether payment data gets shared with a vendor or not centers around data privacy.
Data Security
Data security is very different in that it focuses on how you keep data safe from attackers. You can break down data security into five primary functions:
- Identifying the data, systems, and individuals that need to be factored into your security strategy
- Protecting the systems that hold your data
- Detecting attacks at various stages of their lifecycle
- Responding to attacks in a way that supports both the security of the data and the rest of your governance system by preventing data exfiltration
- Recovering stolen data or a system that has been taken over by a hacker
Data security and privacy definitely play on the same team. A weak data privacy system will hurt your data security and vice versa. Flaws in either will impact your overall data governance system.
How Is Data Governance Essential to Cybersecurity?
Data governance plays an essential role in cybersecurity because data is attackers’ number one target. Keeping data private and protected prevents hackers from exploiting it. At the same time, categorizing and mapping data helps you understand the types of attackers it appeals to, as well as what methods they may try to get it.
Data Governance Best Practices
Here are some of the most successful best practices for effective data governance:
- Identify data domains: Domains, in the context of data, refer to logical data groups. For instance, you can categorize data according to those that use it, such as customers, vendors, shipping companies, or other entities.
- Determine the most important elements in each data domain: Because data domains can involve hundreds, even thousands, of reports and business processes, during the early days, identify only what is important for the business. Scale later as needed.
- Decide whether to adopt a centralized or decentralized operating model: With a centralized model, you have a single management console and point of contact. With a decentralized model, multiple groups have authority over how data is organized, protected, and managed.
- Establish metrics to measure your success: Decide on concrete numerical benchmarks your data governance policy should use as goals. For example, you could set goals regarding the average amount of time it takes someone to access the data they need to do their job.
Data Governance Challenges
Some of the most common data governance challenges include limited resources, a lack of leadership, siloed data, and a lack of control over data:
- A lack of leadership makes it hard for team members to unite around the data governance initiative. You need a data governance champion high up in the organization.
- Siloed data makes it difficult to ensure privacy and security using a single set of tools or principles.
- A lack of control over data can result in security breaches and the organization falling out of compliance with regulations like HIPAA.
A strong data governance system addresses these challenges head-on, paving the way for a smooth, organization-wide implementation.
How Fortinet Can Help
The Fortinet Identity Access Management (IAM) solution incorporates a bevy of tools to keep your data secure from attackers. Features such as multi-factor authentication (MFA), single sign-on (SSO), and bring-your-own-device (BYOD) certificate management combine to provide the kinds of safeguards you need to support a thorough data governance system.
FAQs
What is data governance and why is it important?
Data governance refers to a system that makes sure only authorized people can interact with specific data—while controlling what they can do, in which situation, and the methods they can use. Organizations need to govern data for the same reasons they need to govern their money. Like money, data is valuable. It can be stolen, but when governed properly, data can play a key role in improving core systems.
What are the 4 pillars of data governance?
The four pillars of data governance are data stewardship, data quality, master data management, and use cases.
What is a data governance framework?
A data governance framework is a system of actions upon which you build your governance mechanism. It involves performing due diligence, building a data inventory, building controls, forming a data governance panel, and providing accurate and clear notice regarding policies.
