Making Sense of Data Management

Organizations face a prevalence of both internal and external cyber threats. This makes data management one of the most critical components in an organization’s cybersecurity program. From classifying data, to ensuring it is handled with the appropriate security precautions, to ensuring that data is retained for the appropriate amount of time, data management is an involved process. But having a strong data management program will allow an organization to know that their sensitive information is protected and that they can comply with legal and regulatory requirements.

Data management is the process of handling data throughout its lifecycle. This involves its classification, implementation of appropriate security controls based off the classification, defining retention periods, and eventual destruction. In this article we will focus primarily on classification and retention periods.

Quick Definitions:

Data classification can be defined as a tool for categorization of data to enable/help organizations to effectively answer the following questions:

• What data types are available?
• Where are certain data located?
• What access levels are implemented?
• What protection level is implemented and does it adhere to compliance regulations?

Retention period identifies the duration of time for which data should be maintained or "retained". Guidance for this can come from many different areas, such as regulatory & legal requirements or from internal standards.

Regarding the classification of data, organizations can use various labels to categorize their data such as confidential, private, public, etc. Associated with those classification levels should be the amount of protection that is required for each type of data. This can include the type of encryption that is required for the data at rest or in transit, as well as who has access to that data and the logging of that access. Storage requirements can also be tied into the data’s classification such as what region it can be stored in and what its retention period is.

Having a functioning data classification program will help us comply with legal and regulatory requirements, such as the European Union's General Data Protection Regulation (GDPR) and the Health Insurance Portability and Accountability Act (HIPAA) in the United States. These regulations require organizations to take appropriate measures to protect sensitive data and to be transparent about how they collect, process, and store personal data. These regulations also often define the retention period. Knowing how long we need to hold onto data is important as we need to make sure that we are keeping data as long as is required through law or regulation, but not to exceed that.

Keeping data longer than is required can open an organization up to unnecessary risk such as increased personal identifying information (PII) or protected health information (PHI) disclosure in the event of a breach, to leaked financial records that could have been disposed of. This places an emphasis on knowing and applying data retention appropriately by having a clear understanding of what is required and having an effective data management program to implement these requirements.

However, there are challenges with implementing a data management program. Firstly, it can be difficult to accurately classify data, particularly when the data is complex or when there is ambiguity about the level of sensitivity or criticality. Second, depending on the size and complexity of the organization, data management can require significant investment in technology, processes, and personnel. Sometimes this can be a barrier for organizations that may not have the resources to implement an effective data management system. In addition, ensuring the confidentiality, integrity, and availability of data can be a challenge, particularly in organizations that are dealing with large amounts of data. And lastly, changing regulations, technological advancements, and changing business requirements can make it difficult to maintain an effective data management system.

Thankfully, there are solutions to the problems above. This includes creating a data classification policy that defines the categories of data, the level of protection required, and the responsibilities of employees in protecting sensitive information. It also includes implementing technical controls that will help discover, classify, and protect the data in your environment. However, it can be challenging to know where to start or know which technologies and processes are needed. Compass IT Compliance has professionals that are well versed in all aspects of data management and can assist you and your organization in implementing an affective data management program. Contact us today to discuss your unique situation!