MGMT7020 Chap.12 Data Governance, Information Architecture and Security
Data Governance, Information Architecture and Security
Protecting information
Week 9 covers data structures and governance, information architecture and cybersecurity.
This chapter frames security around confidentiality, integrity and availability and works through a clinic's incidents to show how classifying a breach points to the right control.
Deciding about data
It then sets out data governance roles, from owner to custodian, and links data structures and information architecture back to the modelling and ownership ideas from earlier chapters.
How the three topics connect
Governance, architecture and security reinforce one another.
Clear ownership decides who may use data and how much risk is acceptable. Good architecture reduces duplicate copies that are hard to protect. Security controls then enforce the owner's decisions. A weakness in any one undermines the others, which is why incident questions often have governance answers.
Common errors on this topic
Students often treat cybersecurity as a list of technical products.
Assessors tend to look instead for the property at stake, the likely cause, a proportionate control and the person accountable. Another common slip is to make the IT team the owner of business data, when it is usually the custodian acting on the owner's decisions.
What this chapter covers
- 01
Confidentiality, integrity and availability
- 02
Internal and external threats
- 03
Classifying security incidents
- 04
Data owners, stewards and custodians
- 05
Data quality dimensions
- 06
Data structures and information architecture
Worked example · free
Match controls to three risks in a payroll system
- 1Visible salaries: confidentiality; apply role-based access so staff see only their own records.
- 1Unrecorded changes: integrity; require approval for rate changes and keep an audit trail.
- 1No backup site: availability; set up tested backups and a recovery plan with a target restore time.
Key terms
- Confidentiality
- The property that information is seen only by those authorised to see it.
- Integrity
- The property that information is accurate and changed only with authority.
- Availability
- The property that information and systems can be used when they are needed.
- Data Owner
- The business manager accountable for a data set and for decisions about its use.
- Data Custodian
- The technical role that stores, secures and backs up data for its owner.
- Information Architecture
- The organisation and labelling of information so people can find and use it.
Data Governance, Information Architecture and Security FAQ
What are confidentiality, integrity and availability?
They are the three properties security protects. Confidentiality keeps information from unauthorised eyes, integrity keeps it accurate and properly changed, and availability keeps it usable when needed. Controls often trade one against another.
Who should decide how data is used?
A data owner in the business, accountable for the data set. Stewards look after its quality and definitions day to day, and the IT custodian stores and secures it under the owner's rules.
Is cybersecurity mainly a technical problem?
Not only. Many incidents begin with ordinary mistakes or weak internal controls, and deciding what to protect and how much risk to accept are business decisions, so the risk tools from the project module apply directly.
What does a data steward do?
A data steward looks after the quality and definitions of a data set day to day on behalf of its owner, measuring accuracy, completeness, consistency and timeliness and raising issues that need the owner's decision.
Why are insiders a security risk?
Many incidents start with ordinary mistakes or misuse of legitimate access, such as sending data to the wrong person or changing records without authority. Controls on access, logging and training address these as much as defences against outside attackers.
What is information architecture?
The way information is organised, labelled and connected so people can find and use it, such as how an intranet groups policies or how a records system classifies files. It works above the level of data structures and helps reduce duplicate copies of the same information.
Exam move
Collect three news stories of data breaches and classify each by the property breached, the likely cause and the control that would have helped. Practise naming the data owner for three kinds of data in an organisation you know.
Working through Data Governance, Information Architecture and Security in MGMT7020? Sia is AskSia’s AI Project Management tutor — ask any MGMT7020 Data Governance, Information Architecture and Security question and get a clear, step-by-step explanation grounded in how MGMT7020 is taught and assessed. Read this chapter free, then take your hardest questions to Sia.