All leaders are aware of the varying degrees of sensitive data, personal identifiable information (PII), proprietary data, and operational information that their organisations and industries are expected to protect. This typically aligns with which data is important from a compliance perspective, which data is important from an operational perspective, and which data is sensitive and protected by regulations. Business leaders know what their ‘crown jewels’ are. IT departments do not, and yet they are frequently tasked with keeping data and networks secure.
IT departments and cyber security experts know how to protect data. However, it is often not within their sphere of knowledge to know which data should be protected, or how to respond quickly and effectively to breaches, especially when the point of compromise (POC) and which data has been affected are unclear.
To determine what data constitutes the business’s ‘crown jewels’ — and therefore what data should be protected or deleted if no longer in use — business leaders need to take a comprehensive and strategic approach.
This process begins with a thorough understanding of the company’s core operations, objectives, and the regulatory environment in which it operates. Identify and categorise data based on its significance to the company’s mission and its potential impact on business continuity, competitiveness, and compliance.
There are a few simple steps to getting this right. First, conduct an in-depth analysis of the company’s data landscape. This involves mapping out all types of data generated, stored, and processed within the organisation. By collaborating with department heads and key stakeholders, leaders can gain insights into which data is critical for day-to-day operations, which data supports strategic decision-making, and which data, if compromised, would cause significant harm to the business. This analysis should include not only customer and employee data but also intellectual property, financial records, proprietary algorithms, and strategic plans. Remember, even ‘old’ data can cause regulatory and reputational issues, so have a clear, extensive view of your data.
Second, compliance and regulatory requirements must be considered. In South Africa, the Protection of Personal Information Act (POPIA) protects all personal data. And if your business works with global partners, or does international business, different industries have specific regulations governing data protection as well, such as GDPR for personal data in the European Union, HIPAA for healthcare information in the United States, and others. It’s important to identify which data is subject to these regulations and ensure that it is adequately protected to avoid legal repercussions and maintain customer trust.
You should also evaluate data from an operational perspective. This involves identifying data that is essential for maintaining business operations and ensuring business continuity. For instance, data related to supply chain management, customer orders, and financial transactions might be crucial for keeping the business running smoothly. Protecting this data ensures that the company can continue to function even in the face of cyber threats or data breaches.
This all brings us to why strong data governance is important: business leaders should assess the potential business impact of data breaches. Data that, if exposed, could lead to significant financial loss, reputational damage, or competitive disadvantage should be prioritised. This includes trade secrets, R&D data, and strategic business plans. By understanding the potential fallout from a data breach, leaders can prioritise resources and efforts to protect their most valuable assets. This is not IT’s role.
The best way to maintain strong data governance is through a continuous review process. The business environment and regulatory landscape are constantly evolving, and so too are your company’s data assets. Regular reviews and updates to the data protection strategy ensure that the business remains resilient against emerging threats and compliant with new regulations.
Here are a few additional steps you can take with a multi-faceted data governance approach:
Conduct comprehensive data inventory: Performing basic housekeeping in your environment is crucial. Leaders should initiate a thorough data inventory to understand what data exists, where it is stored, how it is used, and its lifecycle. This includes identifying outdated or redundant data that can be deleted or archived to reduce clutter and potential risks.
Justify data collection and retention: Business leaders should ensure that there is a clear justification for collecting and retaining each type of data. This involves evaluating the necessity of data in relation to business objectives and regulatory requirements. By doing so, organisations can avoid holding unnecessary data that could pose a risk if compromised.
Assign data custodians: Assigning data custodians is essential for effective data governance. Data custodians are responsible for the management, protection, and compliance of specific data sets. This role includes ensuring data accuracy, security, and availability. By clearly defining these responsibilities, organisations can create accountability and enhance data governance.
Implement a robust data governance framework: Develop and enforce a comprehensive data governance framework that includes policies, procedures, and standards for data management. This framework should cover data classification, data handling procedures, access controls, data quality, and compliance requirements. Regular training and awareness programs should be conducted to ensure all employees understand and adhere to these standards.
Establish a data governance committee: Form a data governance committee at the board level, consisting of senior leaders and key stakeholders. This committee should oversee data governance activities, review policies, ensure compliance, and address any issues related to data management. Regular meetings and updates can help keep data governance a priority within the organisation.
Regular audits and assessments: Conduct regular audits and assessments of data governance practices to identify gaps and areas for improvement. This includes evaluating data security measures, compliance with regulations, and the effectiveness of data management processes. Audits should be followed by actionable steps to address any identified issues.
Develop a data breach response plan: Prepare for potential data breaches by developing and regularly updating a data breach response plan. This plan should outline the steps to be taken in the event of a breach, including communication protocols, investigation procedures, and measures to mitigate damage. A well-defined response plan can significantly reduce the impact of a data breach.
How CyberCom Africa can help
CyberCom Africa’s Digital Forensics Incident Response (DFIR) gives our clients the ability to respond rapidly to cyber incidents. Through our Cyber+ offering, we have a unique solution that combines digital forensics expertise, delivered by our sister company, Cyanre Digital Forensics Lab, with 24/7 incident reporting capabilities. The added value included in Cyber+ ensures regular assessments are conducted on a business’s security posture, identify risks and vulnerabilities that should be addressed, and put an incident response plan in place that will facilitate responding to a breach at speed, identifying points of compromise, impact, and what the immediate containment actions needs to be to ensure business continuity and resilience.
All businesses are at risk of suffering a debilitating security incident in their IT infrastructures. CyberCom’s DFIR services gives businesses the ability to respond to these incidents appropriately and be prepared. Our service includes a variety of audits and assessments in order to prevent and detect incidents.