1.2 Data Governance: Roles, Classification & Sanitization Standards
Analyze corporate data governance structures, segregating responsibilities between Data Owners, Data Stewards, and Data Custodians, establishing 4-tier data classification frameworks, and enforcing media sanitization under NIST SP 800-88.
🎯 Essential Technical Takeaways
- Data Owners (business executives) classify data and authorize access; Data Custodians (IT/DBAs) implement technical safeguards and backups.
- Restricted/Secret data classifications require end-to-end encryption at rest and in transit, multi-factor authentication, and explicit access authorization.
- Under NIST SP 800-88, media leaving organizational control must undergo 'Purge' (e.g., cryptographic erase) or physical 'Destroy'.
- Magnetic degaussing is completely ineffective on Solid-State Drives (SSDs); flash memory must be purged via ATA secure erase or shredded.
Data governance establishes enterprise authority and accountability for corporate data assets. Under DAMA-DMBOK and ISACA COBIT frameworks, organizational roles must be strictly segregated: (1) Data Owners are senior business leaders (e.g., Chief Financial Officer or HR VP) who have operational authority over data assets, determine classification levels, and approve user access requests; (2) Data Stewards enforce business data definitions, metadata consistency, and data quality rules; and (3) Data Custodians are technical IT personnel (such as database administrators and storage engineers) who manage storage, execute backups, implement encryption, and enforce the technical controls specified by Data Owners.
Information classification frameworks categorize data based on the business, legal, and financial damage resulting from unauthorized disclosure: Public, Internal, Confidential, and Restricted. Restricted data (including Social Security numbers, payment cards, banking credentials, and proprietary trade secrets) mandates the highest tier of security: AES-256 encryption at rest, TLS 1.3 in transit, and multi-factor authentication.
When decommissioning storage devices that held regulated data, organizations must adhere to NIST SP 800-88 Rev. 1 sanitization standards: Clear, Purge, or Destroy. For media released outside the organization, Purge or Destroy is mandatory. Importantly, magnetic degaussing works exclusively on magnetic media (tapes and HDDs) and is completely ineffective on solid-state drives (SSDs), which store data via semiconductor charge traps.
⚠️ CPA Evolution Exam Traps & Control Pitfalls
- Allowing technical database administrators (custodians) to decide who has business access to financial data.
- Attempting to sanitize flash memory (SSDs) using magnetic degaussing wands.
- Assuming standard operating system file deletion or partition formatting permanently erases confidential data.
Interactive Knowledge Checkpoint
During an internal controls review of a corporate payroll system, an IS auditor notes that the senior database administrator (DBA) establishes data classification levels, approves employee access requests to salary records, and performs nightly database backups. According to established data governance frameworks (such as DAMA-DMBOK and COBIT), which role segregation defect exists?