Cyber criminals are out there. They want your data, and their techniques for acquiring it are getting increasingly advanced. Fortunately, you can mitigate these threats with a solid data governance strategy.
Imagine how much you could get done if you didn’t have to follow lots of rules and regulations on how you handle your business’s data. Employees could access data from anywhere. They could share client data between teams in whatever way got the job done fastest. Your tech team could focus on important projects without having to worry about backing up data.
But danger lurks, and not following data regulation rules would leave your business exposed and vulnerable to cyberattacks. Small businesses are especially vulnerable to cyber crime: 43% of cyber attacks target small businesses, and 60% of those that fall victim to such an attack go out of business.
As a business leader, it is your responsibility to protect your employees, clients, and business.
To do this, you need to step up your data management game.
What is data governance?
Data governance is the initiative a company takes to create and enforce a set of rules and policies regarding its data. These policies cover issues such as:
Assigning accountability to employees responsible for data assets
Granting or restricting access to data, as needed
Maintaining data in a way that ensures accuracy and consistency
Storing your data securely
Backing your data up properly
Protecting your data from internal and external threats
Anything that concerns your company’s data—who sees it, who can access it and from where, as well as how it’s protected—is data governance.
If you want quality data that's protected from cyber criminals and used in accordance with data-sharing laws, you should make data governance a top priority.
And the benefits of data governance don't stop at data security. Data governance can also help with:
Preventing data silos, making data safely accessible across departments.
Providing accurate, consistent data through continual data monitoring and maintenance.
Ensuring compliance with laws that govern data, such as the Sarbanes-Oxley Act or HIPAA.
Good data governance just makes sense. And, in some states, it’s the law.
But implementing data management governance policies needs to be a company-wide effort. Your employees access and use data every day, so their jobs will be affected by any new policies you implement. And, when it comes to data security, your data governance policies will only be effective if everyone follows them. All it takes is one person and one mistake to give a hacker access to your business’s data.
But, because "data" can refer to so many different things, how can you think of all the rules that encompass data usage and protection? Here’s how to think about data governance.
How to implement a new or updated data governance strategy
If implementing a data governance strategy sounds like a hassle, that’s because it is.
It involves lots of planning, changing habits, and pesky workarounds in order to secure data. And if you decide to take data governance seriously, it will take lots of time and trial and error to get policies right. But dealing with a data breach or worse will be a much larger, messier hassle, and your business’s reputation may never recover.
Here are four things to keep in mind as you implement or update data management policies.
1. Define your reasons
Know why you are creating new data policies. Perhaps you’ve spotted vulnerabilities in your company’s data security or your business structure has changed—such as more employees working remotely.
These reasons will help guide you toward policies that directly address your concerns and goals for data management.
2. Inform stakeholders about changes
Stakeholders include your employees, customers, investors, and others. Communicate changes to data management before you implement them. Be transparent about how you’ve tried to mitigate disruptions but that these changes will likely affect them. Tell them how and what they may have to do differently.
Provide stakeholders with an avenue for communication so they can report glitches, challenges, or issues they might have after you set the new data governance policies in motion.
3. Know who is in charge of what
Getting the right people involved is critical to a successful data governance plan.
A strong data governance strategy consists of multiple levels of leadership. On the executive level, you have senior leaders and managers. On the strategic level, you have the Data Governance Council (DGC), which consists of one to two people from each unit or department. At the tactical level, you have Data Domain Stewards and Data Steward Coordinators. At the operational level, you have Data Stewards, who are your employees who use data for daily tasks or projects. Let's take a look at the different roles to understand exactly what each position does.
C-suite executives
Their role: Your top executives are responsible for enforcing new policies from the top down and explaining the effect of new policies on your broader business model to your company’s stakeholders.
Those in the C-suite are in charge of broad sections of your organization. If you’re part of a small company, you might already have chosen some of them to serve on your data governance council. But executives from larger organizations might delegate that role to a senior manager or vice president.
Regardless, the suits need to know what’s going on with the company’s data, especially as it relates to the overall health of the business.
How data governance affects them: Executives will have to follow the same rules as everyone else when it comes to data, although they’ll likely have a higher level of access than most employees.
They’ll also need a better understanding of data governance, in general, receiving regular updates from the DGC. Because, when giant problems, such as a data breach or a cyber attack arise, those at the top need to know what their role is in fixing the problem and helping to put the company back on track. After all, it’s their management style and business sense that will largely be under attack when your customers want answers.
Data governance council
Their role: A data governance council (DGC) is ultimately in charge of high-level decisions involving data. This is the body that will actually create the policies concerning your data.
Your council should be cross-functional—i.e., it should include employees from different parts of your company. This ensures that everyone who uses data is represented. You wouldn’t want your council to create a policy that prevents a particular team from conducting their business efficiently.
Your sales team, for example, probably accesses sensitive client information every day. Someone from the sales team should be involved when new policies related to data access are up for discussion. If you exclude departments, you’ll be leaving areas of your business vulnerable. A data governance strategy only works if all of your bases are covered.
And your IT team, especially, should be represented on the council since they’ll largely be in charge of storing, duplicating, and securing your data.
How data governance affects them: Since you’re not hiring a whole new set of council members, the largest effect of data governance for your DGC will be additional work related to data and data policies. If, or when, something goes wrong, the council will need to step in to examine the problem and recommend a solution.
Managers and team leads
Their role: Two-way communication between the DGC and the rest of your company's employees is a must. Enforcing new policies on a team level is also imperative.
Managers need to know how data governance policies relate to their teams specifically. And they need to be able to communicate with the data governance council when certain policies make their team's jobs more difficult.
For example, say your DGC decided your employees can only access certain client information via your corporate virtual private network (VPN). Employees sign in to the VPN when they log in to their company computers. But your sales reps likely often work from home and use their own devices to close and update deals.
The sales manager and the data governance council need to work out a solution so that no client data is compromised, but the sales team can still do their jobs effectively.
How data governance affects them: Managers will likely be the first point of contact if a team member either requests a change in data policy or violates one. They need to learn how to effectively communicate their team's needs regarding data in order to convey those needs to the DGC.
Employees who access or use data
Their role: Employees who access or use data, which is likely the majority of them, need to actively follow new policies and speak up when a policy makes their job significantly more difficult.
Much like managers, those using or accessing data need to have the ability to communicate their needs.
Going back to our previous example of the sales team, it's likely that a sales rep will communicate the lack of access to client data to their sales manager.
Plenty of lower-level employees handle data on a daily basis. As such, they have the best idea of what data they'll need to access, and how they need to use it.
Your tech team, especially, should feel empowered to speak up. If something goes wrong when backing up data or if they notice suspicious activity on your network, they'll be the first to know.
How data governance affects them: The policies that the data governance council implements directly affects many employees. Especially if they change the way they do their jobs, employees' needs should be the DGC's highest priority after data security.
4. Make sure everyone follows the rules
There should be consistent communication between your DGC and the rest of the business. Employees should be aware of new policies and understand the reasons behind them. For example, one new policy might be that employees can no longer use their personal devices for work-related tasks. This might cause an inconvenience, but communicating the “why” will help employees understand that no longer using work-related devices will keep company information (and their devices safe).
How software can help
A strong data governance strategy is aware of the risks: Ransomware attacks, in particular, are on the rise. These types of cyber crimes specifically target your company's data, and once these cyber criminals have it, they'll destroy or delete it if you don't pay them a certain amount of money.
An average ransom can cost your company about $2,500, not to mention the cost of new security systems.
A strong data governance strategy is also aware of the tools available to them to mitigate these risks.
Tools such as data governance software can help your business manage, visualize, and protect data. Since many US privacy laws are based on GDPR, software platforms that offer GDPR compliance could be a useful tool for ensuring compliance with regulations.
Other tools, such as VPN software can also play a role in protecting your company’s data by protecting your company’s devices.
Additional data governance resources
Whether you’re devising a budget or looking to improve your data governance, Capterra’s blog has you covered: