{"id":5077,"date":"2025-11-03T13:35:16","date_gmt":"2025-11-03T18:35:16","guid":{"rendered":"https:\/\/staging.dcamportal.org\/?p=5077"},"modified":"2026-02-24T15:13:35","modified_gmt":"2026-02-24T20:13:35","slug":"dcam-v3-framework-beta-7-0-data-management-operations-risk-control","status":"publish","type":"post","link":"https:\/\/staging.dcamportal.org\/fr\/dcam-v3-framework-7-data-management-operations-risk-control\/","title":{"rendered":"Cadre DCAM v3 - 7.0 Op\u00e9rations de gestion des donn\u00e9es, risques et contr\u00f4les"},"content":{"rendered":"
\r\n
\r\n
\r\n
\r\n
\r\n\r\n\r\n\r\n<\/div>\r\n<\/div>\r\n\r\n\r\n\r\n

\"DCAM<\/p>\r\n\r\n

\r\n
\r\n\r\n

Upper Matter<\/h3>\r\n<\/div>\r\n
\r\n
\r\n

Introduction<\/h3>\r\nThe Data Management Operations, Risk & Control<\/b> refers to the state of operation in which the data assets of an organization are holistically managed throughout the organization. There are three elements of a successful data management environment.\r\n
    \r\n \t
  1. The data management (DM) objectives and capabilities described within this document have been embraced and adopted throughout the organization.<\/li>\r\n \t
  2. The data lifecycle<\/span> is fully supported by all stakeholders. These stakeholders ensure understanding, awareness and control of data throughout the data supply chain–from source to consumption to disposition.<\/li>\r\n \t
  3. DM is part of the organization’s data ecosystem. It is integrated and coordinated with all other control functions organization-wide.<\/li>\r\n<\/ol>\nThe Data Management Operations, Risk, and Control component addresses the organization’s operational implementation of Data Management through the coordination of resources, processes, and technology in a cohesive and consistent set of practices. The Data Development Life Cycle is a key capability for managing data throughout its entire lifespan of data within an organization. It ensures confidentiality, integrity, and availability of data, and the storage, usage, analysis, and disposition of data, while maximizing its value and meeting business objectives. Data development life cycle management enables better data risk and control management, while providing coordination and collaboration of resources, practices, and methods for other DCAM<\/span> concepts including data requirements, data architecture<\/span>, data quality<\/span>, and data governance.\n\nThe extent to which the Data Development Life Cycle is achieved impacts the improvement of data risk management results. Data risk should be defined and managed in alignment with the organization’s risk management framework. Well-coordinated Data Management is foundational for organizations striving to optimize Data Management Operations, comply with regulatory requirements, and unlock business value from data.\n

    Definition<\/h3>\r\nThe Data Management Operations, Risk & Control<\/b> component consists of capabilities that form a data management environment to oversee and control an organization’s data assets. It incorporates consistent life cycle practices, data risk and controls management, and necessitates organizational collaboration, accountability, and alignment with strategic objectives.\r\n

    Scope<\/h3>\r\n
      \r\n \t
    • Establish consistent data development life cycle practices to enable a sustainable business-as-usual environment for data management.<\/li>\r\n \t
    • Align the people, processes, technologies, and Data Management practices across the organization to achieve a coherent, end-to-end data ecosystem.<\/li>\r\n \t
    • Align Data Management with the organization’s over-arching risk management to establish data risk management approach and plan.<\/li>\r\n<\/ul>\r\n

      Value Proposition<\/h3>\nThe DCAM<\/span> framework enables a comprehensive approach to managing data throughout its life cycle, with controls based on detailed data requirements, a cohesive risk mitigation strategy, and a clear accountability structure. These capabilities enable individuals at all organizational levels to participate effectively in data management. Strategic and operational objectives that depend on data are supported by this approach, which allows organizations to balance the creation of value from data with the management of data risk. Such an approach fosters a high-quality and sustainable data ecosystem that can be critical to delivering the organization's business strategy and regulatory obligations.\n

      Overview<\/h3>\nEnabling the DCAM<\/span> framework means embedding core data management components—Architecture (Business, Data and Technology), Data Quality<\/span>, and Data Governance—across all stages of an organization's Data Development Life Cycle. The diagram below presents a visual representation of the DCAM<\/span> Framework Components aligned to manage data from requirements through disposition.\n

      \"Operationalizing<\/p>\r\n

      Diagram 7.1: Operationalizing DCAM<\/span><\/p>\nThe diagram serves as a visual representation reinforcing the importance of data requirements, Data Development Life Cycle management and data control in achieving data excellence. Key characteristics of operationalizing DCAM<\/span> include:\n

        \r\n \t
      • Collaboration, culture accountability:<\/b> Success in data management relies on a data-driven culture, clear accountability, strong leadership, data literacy, and active engagement from everyone. Collaboration across the organization is vital for maintaining an effective data ecosystem. For example, teams that manage information security, storage management, legal and compliance, privacy, and vendor management all have responsibilities that impact how data is managed.<\/li>\r\n \t
      • Data Development Life Cycle:<\/b> orchestrates Data Management activities across the organization leveraging a standard<\/span>, consistent, repeatable methodology. Data Development Life Cycle aligns Data Management activities in an operational flow, ensuring each is resourced, prioritized, and supported by business, data, and technology functions. Coordinating teams across these activities is crucial for the success of the Data Management initiative.<\/li>\r\n \t
      • Business Driven:<\/b> a business-driven data management organization ensures that data is trusted, accessible, and actionable, which enables the company to make informed decisions, optimize operations, and gain a competitive edge. Instead of data being a byproduct of operations, it becomes a core driver of business success.<\/li>\r\n \t
      • Curated metadata<\/span>:<\/b> serves as the foundation of data life cycle management, allowing organizations to define, track, and manage data requirements, risks, controls, and accountabilities. Metadata<\/span> facilitates data management automation.<\/li>\r\n \t
      • Requirement traceability:<\/b> should be comprehensive to capture a full set of business needs, for example, data processing rules, retention, disposal, quality dimensions, ownership, ethical use, and other operational aspects of DCAM<\/span> capabilities. This is particularly critical for data that is shared among multiple data consumers and for core data attributes that are used as a baseline for onward expression in operational calculations or business formulas.<\/li>\r\n \t
      • Standardized Data Management controls:<\/b> are consistently applied to data throughout life cycle stages ensuring best practice for designing, deploying, executing, and documenting controls. This enhances efficiency and reuse across the organization. An inventory of all data controls is essential for data availability, accountability, quality, risk mitigation and alignment with business goals.<\/li>\r\n \t
      • Aligned to Data Management Policy<\/span> and Standards:<\/b> A standard<\/span> Data Development Life Cycle ensures adherence to Data Management best practices and coordination with organizational processes like Software Development Life Cycle and business architecture<\/span>. Operating collaboratively within an ecosystem acknowledges interdependence.<\/li>\r\n<\/ul>\nThe goal is to create a secure, scalable, and sustainable data ecosystem that controls and provides data for business needs. The Data Development Life Cycle orchestrates the Data Management components to manage data effectively across the organization. A consistent Data Development Life Cycle aligns capabilities in an operational flow, ensuring each element is resourced, prioritized, and supported by business, data, and technology functions. Coordination and collaboration are crucial for the success of the Data Management initiative. It is the responsibility of the Data Management organization and the senior data officer<\/span> at each level of the organization to coordinate and manage the Data Development Life Cycle model<\/span>. This properly defines data meaning, ensures data quality<\/span>, facilitates data governance, and supports the delivery of data in a timely and efficient manner. Evidence of the processes and their adoption must be documented and compiled through demonstration of organizational structures, charters, policies, and senior management directives.\n

        Core Questions<\/h3>\r\n
          \r\n \t
        • Is a data life cycle management approach used to control data management of in-scope data?<\/li>\r\n \t
        • Is the data life cycle aligned and supported by data management policies and standards?<\/li>\r\n \t
        • Are appropriate controls applied across the full data life cycle?<\/li>\r\n \t
        • Are the concepts of data control aligned across the full organization ecosystem (people, process<\/span> and technology)?<\/li>\r\n \t
        • Is Data Management aligned with Enterprise<\/span> Risk Management practices in support of data risk management?<\/li>\r\n \t
        • Are data risks aligned to the business data requirements?<\/li>\r\n \t
        • Are data contract<\/span> and sharing agreements identified and managed?<\/li>\r\n<\/ul>\r\n

          Core Artifacts<\/h3>\r\n
            \r\n \t
          • Data Development Life Cycle<\/li>\r\n \t
          • Data Requirements Inventory<\/li>\r\n \t
          • Data Risk Taxonomy<\/span><\/li>\r\n \t
          • Data Controls Inventory<\/li>\r\n \t
          • Data Risk Issues Log<\/li>\r\n \t
          • Data Sharing Agreement<\/span><\/li>\r\n<\/ul>\r\n\r\n\r\n<\/div>\r\n<\/div>\r\n\r\n
            \r\n\r\n

            7.1 Data Management Operations<\/h3>\r\n<\/div>\r\n
            \r\n
            \n\nData Management Operations must identify, understand, and prioritize the delivery of requirements for curated data, and mitigate data risk through effective controls. Data Management Operations are based around ensuring the data assets are managed properly throughout the data development life cycle, is a strategic imperative for any data centric organization. This calls for a standard<\/span> data development life cycle approach to be applied consistently both to structured and unstructured data across the organization, holistic data requirements, and proper management of data providers.\n\nA standardized approach to managing data throughout its life cycle, can optimize an organization’s operations. This includes ensuring that data is properly created, processed, stored, maintained, and disposed, thus limiting redundancy, achieving data minimization and optimizing storage costs.\n\n\n\n<\/div>\r\n<\/div>\r\n\r\n
            \r\n\r\n

            7.1.1 Data Development Life Cycle Approach<\/h3>\r\n<\/div>\r\n
            \r\n
            \r\n
            Description<\/h5>\nThe Data Development Life Cycle is a comprehensive model<\/span> to manage data from initial creation to final disposition. It involves a series of phases that ensure data is handled efficiently, securely, and in support of established business requirements and objectives.\n
            Objectives<\/h5>\r\n
              \r\n \t
            • Establish a standardized data development life cycle to ensure consistent data management practices and processes.<\/li>\r\n<\/ul>\r\n
              Advice<\/h5>\nThe Data Development Life Cycles of individual organizations will vary, but each will typically encompass data acquisition, processing, storage, maintenance, distribution, consumption, archiving, and disposal. Holistic data requirements must be captured to support control of the data at each successive life cycle stage. Implementing the data life cycle approach requires careful prioritization and planning typically executed on an iterative basis over an extended timeframe.\n\nImplementation of the data development life cycle approach can be highly complex, especially in large organizations with multiple data domains, diverse data types, and cross jurisdiction needs. It may be prudent to phase the roll-out of the data development life cycle, based on well-understood organization priorities and carefully planned scope that may be incrementally expanded.\n\nThe Data Development Life Cycle Approach should consider and address the alignment and enablement of DCAM<\/span> components through the life cycle stages as necessary. It should reflect the use and application of resources (people, process<\/span> and technology) across the stages of the data life cycle.\n
              Questions<\/h5>\r\n
                \r\n \t
              • Does the organization use a Data Development Life Cycle for its model<\/span> to consistently manage data?<\/li>\r\n \t
              • Is the data development life cycle supported by policy<\/span>, standards, and processes for use in managing data (structured and unstructured) with provision for handling exceptions<\/li>\r\n<\/ul>\r\n
                Artifacts<\/h5>\r\n
                  \r\n \t
                • Data Governance Approach & Plan<\/li>\r\n \t
                • Data Lifecycle<\/span> Process<\/span> and Standards<\/li>\r\n<\/ul>\r\n
                  Scoring<\/h5>\r\n
                  \r\n
                  \r\n
                  \r\n
                  \r\n\r\nNot Initiated\r\n\r\n<\/div>\r\n\r\n
                  \r\n\r\nNo formal Data Life Cycle Approach exists.\r\n\r\n<\/div>\r\n\r\n\r\n<\/div>\r\n\r\n
                  \r\n
                  \r\n\r\nConceptual\r\n\r\n<\/div>\r\n\r\n
                  \r\n\r\nNo formal Data Life Cycle Approach exists, but the need is recognized, and the development is being discussed.\r\n\r\n<\/div>\r\n\r\n\r\n<\/div>\r\n\r\n
                  \r\n
                  \r\n\r\nDevelopmental\r\n\r\n<\/div>\r\n\r\n
                  \r\n\r\nFormal Data Life Cycle Approach is being developed.\r\n\r\n<\/div>\r\n\r\n\r\n<\/div>\r\n\r\n
                  \r\n
                  \r\n\r\nDefined\r\n\r\n<\/div>\r\n\r\n
                  \r\n\r\nThe Data Development Life Cycle Approach is defined, validated and approved by the directly involved stakeholders.\r\n\r\n<\/div>\r\n\r\n\r\n<\/div>\r\n\r\n
                  \r\n
                  \r\n\r\nAchieved\r\n\r\n<\/div>\r\n\r\n
                  \r\n\r\nThe formal Data Development Life Cycle Approach is established and applied to Data Management initiatives.\r\n\r\n<\/div>\r\n\r\n\r\n<\/div>\r\n\r\n
                  \r\n
                  \r\n\r\nEnhanced\r\n\r\n<\/div>\r\n\r\n
                  \r\n\r\nThe Data Development Life Cycle Approach is part of business-as-usual practice and is assessed regularly for current relevance and efficacy.\r\n\r\n<\/div>\r\n\r\n\r\n<\/div>\r\n\r\n\r\n<\/div>\r\n\r\n\r\n<\/div>\r\n\r\n\r\n\r\n\r\n<\/div>\r\n<\/div>\r\n\r\n
                  \r\n\r\n

                  7.1.2 Data Requirements Approach<\/h3>\r\n<\/div>\r\n\r\n
                  \r\n
                  \r\n
                  Description<\/h5>\r\nData is managed through the data development life cycle stages based on data requirements that are established and tracked to meet specific business objectives. Data Requirements Management requires processes and procedures to identify, define, prioritize, validate, track and document the data needs of the business.\r\n
                  Objectives<\/h5>\r\n
                    \r\n \t
                  • Capture and manage data requirements consistently in support of business objectives.<\/li>\r\n \t
                  • Manage data requirements according to established processes and procedures.<\/li>\r\n \t
                  • Document the alignment of data requirements to business and technology processes, the data life cycle stages, data risks, and data controls.<\/li>\r\n<\/ul>\r\n
                    Advice<\/h5>\nData is managed throughout the data life cycle stages using processes and controls that satisfy holistic, detailed data requirements. The data management organization facilitates the process<\/span> in collaboration with all stakeholders including but not limited to<\/em>, business, architecture, and technology. Data requirements address the organization’s strategic and operational objectives such as data quality<\/span>, availability, cost efficiency, business value creation and regulatory compliance. Requirements<\/em> may be defined at any level of data including impacting single physical elements, business elements, classifications, data domains, regional or application-based data sets, and data products. Requirements may relate to one or more life cycle stages and must reflect specific operational constraints. Data requirements must be reviewed and curated consistently with the organization’s<\/em> data governance practices. Requirements<\/em> can be mapped to business and technology processes, data life cycle stages, risks and controls and should be made discoverable as metadata<\/span> for use by automated and manual processes.\n
                    Questions<\/h5>\r\n
                      \r\n \t
                    • Are data requirements identified, captured, evaluated and verified with stakeholders?<\/li>\r\n \t
                    • Are data requirements mapped to business objectives and stakeholders?<\/li>\r\n \t
                    • Are data requirements regularly reviewed and updated?<\/li>\r\n \t
                    • Are data requirements validated against standards?<\/li>\r\n<\/ul>\r\n
                      Artifacts<\/h5>\r\n
                        \r\n \t
                      • Data requirements standards, processes, procedures, and user guide for curating data requirements<\/li>\r\n<\/ul>\r\n
                        Scoring<\/h5>\r\n
                        \r\n
                        \r\n
                        \r\n
                        \r\n\r\nNot Initiated\r\n\r\n<\/div>\r\n\r\n
                        \r\n\r\nNo formal Data Requirements Approach exists.\r\n\r\n<\/div>\r\n\r\n\r\n<\/div>\r\n\r\n
                        \r\n
                        \r\n\r\nConceptual\r\n\r\n<\/div>\r\n\r\n
                        \r\n\r\nNo formal Data Requirements Approach exists, but the need is recognized, and the development is being discussed.\r\n\r\n<\/div>\r\n\r\n\r\n<\/div>\r\n\r\n
                        \r\n
                        \r\n\r\nDevelopmental\r\n\r\n<\/div>\r\n\r\n
                        \r\n\r\nThe formal Data Requirements Approach is being developed.\r\n\r\n<\/div>\r\n\r\n\r\n<\/div>\r\n\r\n
                        \r\n
                        \r\n\r\nDefined\r\n\r\n<\/div>\r\n\r\n
                        \n\nThe Data Requirements Approach is defined, validated, and approved by the directly involved stakeholder<\/span>.\n\n<\/div>\r\n\r\n\r\n<\/div>\r\n\r\n
                        \r\n
                        \r\n\r\nAchieved\r\n\r\n<\/div>\r\n\r\n
                        \n\nThe formal Data Requirements Approach is established and is the standard<\/span> for managing data requirements.\n\n<\/div>\r\n\r\n\r\n<\/div>\r\n\r\n
                        \r\n
                        \r\n\r\nEnhanced\r\n\r\n<\/div>\r\n\r\n
                        \r\n\r\nThe Data Requirements Approach is part of business-as-usual practice and is assessed regularly for current relevance and efficacy.\r\n\r\n<\/div>\r\n\r\n\r\n<\/div>\r\n\r\n\r\n<\/div>\r\n\r\n\r\n<\/div>\r\n\r\n\r\n\r\n\r\n<\/div>\r\n<\/div>\r\n\r\n
                        \r\n\r\n

                        7.1.3 Data Provider Management Approach<\/h3>\r\n<\/div>\r\n\r\n
                        \r\n
                        \r\n
                        Description<\/h5>\r\nData Provider Management involves a set of practices designed to organize and manage third-party contractual agreements and Data Sharing Agreements. Key objectives include ensuring the data source is suitable to meet the business data requirements of the consumer and that quality data delivery is established and maintained. It is important to consistently manage and maintain agreements with data providers whether internal or external.\r\n
                        Objectives<\/h5>\r\n
                          \r\n \t
                        • Ensure a formal consistent approach to management of data sharing that covers internal and external providers based on service level agreements, data sharing agreements, or third-party contracts.<\/li>\r\n \t
                        • Comply with internal policies, relevant laws, rules, and regulations related to data collection, storage, management, usage and retirement of the data.<\/li>\r\n \t
                        • Ensure that data requirements communicated to data providers are aligned to and driven by business requirements, reflecting any data risk management, data quality<\/span>, or data life cycle needs.<\/li>\r\n<\/ul>\r\n
                          Advice<\/h5>\nThe approach to managing and coordinating data providers should be embodied in a common set of practices ensuring consistency<\/span> in how the organization engages with data providers both internal and external. Effective provider management relies on mapping data requirements to the appropriate sources (internal or external) and establishing, managing and monitoring service level agreements to meet business objectives.\n\nThe process<\/span> for identifying and selecting data providers should ensure that the organization does not duplicate data acquisition and establishes measurable service levels and data quality<\/span> criteria between the parties. The approach should specify how a provider’s performance will be evaluated, how remediation requests will be reported and tracked, and how quality or process<\/span> issues will be remediated. Data Provider Management should be aligned with the organization’s data development life cycle and relevant DCAM<\/span> components. Data assets with associated agreements must be governed through the organization’s standard<\/span> data life cycle, ensuring formal management of agreement obligations.\n\nThe third-party contracting process<\/span> should involve assessing the provider’s data practices to ensure they align with business requirements. If a dedicated vendor management function<\/span> exists, consider incorporating data provider due diligence controls into the procurement processes.\n
                          Questions<\/h5>\r\n
                            \r\n \t
                          • How are data sourcing requirements captured, validated and prioritized?<\/li>\r\n \t
                          • Are detailed aspects (e.g., timing, use limitations, content) of agreements or contracts captured, understood, stored and managed?<\/li>\r\n \t
                          • How is data provider service, content quality and performance assessed and managed?<\/li>\r\n \t
                          • Has the Data Governance function<\/span> been granted authority to implement the Approach?<\/li>\r\n \t
                          • Do data sharing standards exist that can be used internally and with external data providers?<\/li>\r\n<\/ul>\r\n
                            Artifacts<\/h5>\r\n
                              \r\n \t
                            • Data Provider Management Process<\/span><\/li>\r\n \t
                            • Data Sharing Agreement<\/span> Templates<\/li>\r\n \t
                            • Data Provider Reporting<\/li>\r\n \t
                            • Repository of Data Sharing Agreements<\/li>\r\n<\/ul>\r\n
                              Scoring<\/h5>\r\n
                              \r\n
                              \r\n
                              \r\n
                              \r\n\r\nNot Initiated\r\n\r\n<\/div>\r\n\r\n
                              \r\n\r\nNo formal Data Provider Management Approach exists.\r\n\r\n<\/div>\r\n\r\n\r\n<\/div>\r\n\r\n
                              \r\n
                              \r\n\r\nConceptual\r\n\r\n<\/div>\r\n\r\n
                              \r\n\r\nNo formal Data Provider Management Approach exists, but the need is understood, and discussions are occurring.\r\n\r\n<\/div>\r\n\r\n\r\n<\/div>\r\n\r\n
                              \r\n
                              \r\n\r\nDevelopmental\r\n\r\n<\/div>\r\n\r\n
                              \r\n\r\nFormal Data Provider Management Approach is under development.\r\n\r\n<\/div>\r\n\r\n\r\n<\/div>\r\n\r\n
                              \r\n
                              \r\n\r\nDefined\r\n\r\n<\/div>\r\n\r\n
                              \r\n\r\nThe Data Sharing Management Approach is defined, validated and approved by relevant stakeholders.\r\n\r\n<\/div>\r\n\r\n\r\n<\/div>\r\n\r\n
                              \r\n
                              \r\n\r\nAchieved\r\n\r\n<\/div>\r\n\r\n
                              \r\n\r\nThe Data Provider Management Approach is established and is recognized and followed by stakeholders.\r\n\r\n<\/div>\r\n\r\n\r\n<\/div>\r\n\r\n
                              \r\n
                              \r\n\r\nEnhanced\r\n\r\n<\/div>\r\n\r\n
                              \r\n\r\nThe Data Provider Management Approach is considered part of business-as-usual practice and is assessed regularly for current relevance and efficacy.\r\n\r\n<\/div>\r\n\r\n\r\n<\/div>\r\n\r\n\r\n<\/div>\r\n\r\n\r\n<\/div>\r\n\r\n\r\n\r\n\r\n<\/div>\r\n<\/div>\r\n\r\n
                              \r\n\r\n

                              7.2 Data Risk Management<\/h3>\r\n<\/div>\r\n
                              \r\n
                              \r\n\r\nContinuous assessment of data risk and enhancement of the organization’s response to threats is the basis of effective data management. It is crucial to identify, categorize, mitigate, and track the inherent data risks and the residual risk after mitigation actions.\r\n
                                \r\n \t
                              • Inherent data risks pertain to the potential data vulnerabilities present within an organization’s data management processes and infrastructure before any data risk controls are implemented. Inherent data risks may include the possibility of data being lost or stolen, erroneous or missing, wrongly retained, wrongly deleted, used illegally, or used inappropriately. Organizations should define their data risk requirements to define the appropriate mitigation efforts.<\/li>\r\n \t
                              • Residual data risks refer to the levels of risk that persist after risk mitigation measures have been enacted.<\/li>\r\n<\/ul>\nBy understanding inherent and residual data risk alongside data risk policy<\/span>, the organization can implement targeted mitigation measures that align with its broader data management strategy and data life cycle. This alignment ensures consistency<\/span> in data risk management, leverages data governance for accountability and oversight, integrates risk considerations into data-related business decisions, and enables proactive identification and management of issues.\n\nWhen establishing and maintaining a data risk management approach, the organization should consider factors such as its objectives, industry specifics, regulatory landscape, financial implications, reputation, stakeholder<\/span> expectations, operational capabilities, risk culture, potential impact, and likelihood of risk events. Effective data risk management practices ensure the quality, integrity, availability, and security of data assets while maintaining regulatory compliance and supporting informed decision-making across the enterprise<\/span>.\n\n\n\n<\/div>\r\n<\/div>\r\n\r\n
                                \r\n\r\n

                                7.2.1 Data Risk Management Approach<\/h3>\r\n<\/div>\r\n\r\n
                                \r\n
                                \r\n
                                Description<\/h5>\r\nThe organization's Data Risk Management Approach provides a foundation to identify, assess, and mitigate data-related risks. The approach must also address that classes and levels of risk may be redefined over time and that can impact the efficacy of both planned and already implemented mitigation approaches.\r\n
                                Objectives<\/h5>\r\n
                                  \r\n \t
                                • Establish a Data Risk Management Approach aligned with the organization’s Risk Management Framework.<\/li>\r\n \t
                                • Establish mechanisms for measurement, reporting, and escalation of data risk.<\/li>\r\n<\/ul>\r\n
                                  Advice<\/h5>\nThe Data Risk Management Approach must encompass a set of policies, standards, roles and responsibilities designed to manage data risk across the organization. The management of data risk should be integrated or aligned with the organization's overall approach to risk management (as appropriate to the nature of the organization) using a complete representation of data risk. Data risk is a critical component of the organization’s risk profile that must be clearly defined, as data supports all business activities and can have significant impacts. Without a clearly defined sense of data risks, determining the most appropriate data controls for mitigation becomes impossible. Once controls are in place to address identified data risks, a data management issue reporting process<\/span> should be established to facilitate risk identification, assessment, and prioritization of remedial actions.\n
                                  Questions<\/h5>\r\n
                                    \r\n \t
                                  • Does the organization have a defined Data Risk Management Approach<\/li>\r\n \t
                                  • Has the organization defined its data risk policies including key risk indicators?<\/li>\r\n \t
                                  • Does the organization have a detailed data risk taxonomy<\/span>?<\/li>\r\n \t
                                  • Does the organization define data risk within the broader risk taxonomy<\/span> or risk management framework?<\/li>\r\n \t
                                  • Are data risks aligned to data context(s) such as business processes, data life cycle stages or chart of accounts?<\/li>\r\n \t
                                  • Is there an inventory of data risk controls documented within the organization, and have they been mapped based on the data risk taxonomy<\/span> and data life cycle?<\/li>\r\n<\/ul>\r\n
                                    Artifacts<\/h5>\r\n
                                      \r\n \t
                                    • Data Risk Management Approach<\/li>\r\n \t
                                    • Data risk policy<\/span>, standards and procedures<\/li>\r\n \t
                                    • Data Risk Requirements (using key risk indicators)<\/li>\r\n \t
                                    • Data Risk Taxonomy<\/span><\/li>\r\n \t
                                    • Inventory of data risk controls<\/li>\r\n<\/ul>\r\n
                                      Scoring<\/h5>\r\n
                                      \r\n
                                      \r\n
                                      \r\n
                                      \r\n\r\nNot Initiated\r\n\r\n<\/div>\r\n\r\n
                                      \r\n\r\nNo formal Data Risk Management Approach exists.\r\n\r\n<\/div>\r\n\r\n\r\n<\/div>\r\n\r\n
                                      \r\n
                                      \r\n\r\nConceptual\r\n\r\n<\/div>\r\n\r\n
                                      \r\n\r\nNo formal Data Risk Management Approach exists but the need is recognized, and discussion is occurring.\r\n\r\n<\/div>\r\n\r\n\r\n<\/div>\r\n\r\n
                                      \r\n
                                      \r\n\r\nDevelopmental\r\n\r\n<\/div>\r\n\r\n
                                      \r\n\r\nThe formal Data Risk Management Approach is being developed.\r\n\r\n<\/div>\r\n\r\n\r\n<\/div>\r\n\r\n
                                      \r\n
                                      \r\n\r\nDefined\r\n\r\n<\/div>\r\n\r\n
                                      \r\n\r\nThe Data Risk Management Approach exists and has been approved by the stakeholders.\r\n\r\n<\/div>\r\n\r\n\r\n<\/div>\r\n\r\n
                                      \r\n
                                      \r\n\r\nAchieved\r\n\r\n<\/div>\r\n\r\n
                                      \r\n\r\nThe Data Risk Management Approach has been established and is being used to direct the management of data risk.\r\n\r\n<\/div>\r\n\r\n\r\n<\/div>\r\n\r\n
                                      \r\n
                                      \r\n\r\nEnhanced\r\n\r\n<\/div>\r\n\r\n
                                      \r\n\r\nThe Data Risk Management Approach is being used in business-as-usual activity and is and is assessed regularly for current relevance and efficacy.\r\n\r\n<\/div>\r\n\r\n\r\n<\/div>\r\n\r\n\r\n<\/div>\r\n\r\n\r\n<\/div>\r\n\r\n\r\n\r\n\r\n<\/div>\r\n\r\n\r\n<\/div>\r\n\r\n
                                      \r\n\r\n

                                      7.2.2 Data Risk Review Plan and Methodology<\/h3>\r\n<\/div>\r\n\r\n
                                      \r\n
                                      \r\n
                                      Description<\/h5>\r\nThe team responsible for data risk review in the organization needs to develop and maintain a plan and the appropriate methods for reviewing data risk management. It manages the relevant plan and methods for conducting data risk reviews for compliance by those accountable for actively managing and handling data.\r\n
                                      Objectives<\/h5>\r\n