The Real Test of Data Governance Should Come Before a Crisis 

When a crisis as large as the recent Binance theft occurs, the subsequent investigation will sooner or later land on governance. As the immediate response unfolds, the deeper question becomes whether the organization had enough oversight of its most consequential systems to prevent a compromise from becoming an enterprise-wide event. 

But for any organization facing any consequential data incident, the real data governance test should come before any crisis situation forces its hand. This is where unstructured data presents a particular challenge. Sensitive unstructured files can easily fall outside clear ownership or meaningful review, leaving organizational leadership unable to have confidence in their control over data for which they are accountable. 

The gap between policy and control 

Essentially, good governance depends on organizations knowing what information they hold and then being able to apply specific rules to it. Unstructured data, however, is something of a wildcard because it rarely stays still. For example, files are created (cumulatively in huge volumes) for a specific purpose. They are copied, amended, shared widely, re-amended multiple times, forgotten about, lost . . . the list goes on. 

Over time, the original context will fade. Ownership can become completely opaque, and files can easily fall outside meaningful review even while the relevant governance policies remain in place. Information can also remain fully accessible long after it should have been restricted or removed, and when that involves sensitive data, there is potential (however small) for disaster. 

How can any organization, for example, be expected to have confidence in its governance processes if it lacks visibility into what data it holds and whether it is being managed in line with policy? 

This will never happen again (probably) 

But what does effective data visibility (pun intended) look like? Essentially, it gives organizations a current and accurate view of the information they hold, both standard and sensitive, including files whose ownership is unclear or whose access arrangements need review. 

This allows governance to become a much more active process. For instance, a file may require tighter permissions, or it may need to be removed from an active environment once its original purpose has changed. The point is,management should understand the situation and be able to act on it in line with policy. Everyone involved, including those at board level, can then demonstrate that governance is being applied across the estate, rather than attempting to plug any gaps only after an incident has occurred. 

Governance should provide an ongoing view of where exposure may be developing as data changes over time. This gives management a basis for intervention before an issue reaches the board via an incident. The real test is whether leaders can obtain credible assurance in ordinary circumstances, rather than trying to reconstruct the organization’s data position during a crisis. It’s an approach that can spare leaders from the familiar post-crisis pledge that steps will be taken to ensure it never happens again.