- [Narrator] Data security is a complex problem
and many different people throughout the organization
play a role in protecting information.
Let's take a look at some of the concepts
surrounding data ownership and stewardship.
Data governance in many organizations
follows a three-tiered model of roles.
At the highest level, the data owner
for particular datasets is a senior-level official
who bears overall responsibility for that data.
The data owner sets policies and guidelines
around data use and data security
and has the authority to make final decisions
regarding a dataset.
Data owners are usually the business leaders
who have responsibility for the mission area
most closely related to the dataset.
For example, an organization's vice president
for human resources might be the data owner
for employment information.
Practically speaking, most individuals
who are senior enough to hold the position
of data owner do not have the time available
to get involved in the nitty gritty decisions
of data governance.
They usually delegate that responsibility to a data steward.
The data steward handles the implementation
of the high-level policies set by the data owner.
For example, a data steward might make day to day
decisions about who may access a dataset.
In the case of an employee dataset,
if the data owner is the vice president
for human resources, that vice president
might delegate data stewardship responsibility
to a director for HR information services.
In most cases there is a reporting relationship
between the data owner and the data steward.
Data custodians or data processors
are the individuals who actually store
and process the information in question.
IT staff often find themselves
in the position of data custodian
because of their roles as systems owners
and administrators.
Technologists are rarely data owners
or data steward but they are often
data custodians for almost all of the data
in the organization due to the nature of their jobs.
Data stewards ensure that appropriate data protections
are in place, including encryption,
backups, access controls, and other mechanisms
that meet the requirements set forth
by data owners and stewards.
In addition to security,
data owners have a responsibility to ensure
that the organization fulfills its privacy requirements.
These requirements may come from legal,
contractual, or ethical obligations.
For example, if an organization stores
the Social Security numbers of employees,
the data owner should make sure that those numbers
are properly protected and only used
for legitimate business purposes.
Data custodians and processors
must also ensure that these protections
are in place and functioning properly.
One last note as you prepare for the exam.
It's very important to draw a distinction
between a system owner or an asset owner
and a data owner.
Just because you might physically own a system
does not mean that you also own
all of the information stored or processed on that system.
This is true both within an organization
and when data is shared between organizations.