T71 Data Classification Program

An Information Governance framework is to be established with regard to placement of data in information classes (i.e., security categories) as well as allocation of ownership. The access rules for governance will be appropriately defined. Treadstone 71 can help you establish a scheme that applies throughout the enterprise, based on the criticality and sensitivity (e.g., public, proprietary, confidential, restricted confidential) of enterprise data. This scheme includes details about data ownership, definition of appropriate security levels and protection controls, and a brief description of data retention and destruction requirements, criticality and sensitivity. It is used as the basis for applying controls such as access controls, archiving or encryption. Treadstone 71 will help you:

Form a strong information governance and stewardship program and a governance committee that includes direct accountability for data consistency and quality

Define information governance processes, policies, procedures and metrics to measure the effectiveness of the governance and information quality participation from the business

Identify authoritative information sources across the board based on what business identifies as core information and establish enterprise-wide conceptual information model as well as enterprise data dictionary and metadata repository

Treadstone 71 works with you to establish a team that is charged with defining, implementing and maintaining security levels for each of the data classifications identified above the level of “no protection required.” These security levels represent the appropriate (minimum) set of security and control measures for each of the classifications and are to be re-evaluated periodically and modified accordingly. Criteria for supporting different levels of security in the extended enterprise is also to be established to address the needs of evolving e-commerce, mobile computing and offshore environments, non-inclusively.

Treadstone 71 helps you understand what is realistically achievable. Not organizations are ready to accept the disciplines required for a complete information governance program.Therefore, a realistic assessment is needed concerning the readiness of your company. Let this understanding guide our development of information governance. Most company's are ready to establish such a program. Treadstone 71 takes you through this difficult maze.

Regardless of the approach chosen, it is important that key stakeholders be part of the information governance strategy and design. Individuals that feel they are part of the strategy are more likely to support it during implementation.

Companies must garner C-level executive management and risk management support for the information governance process because it requires a detailed understanding of the entire company's business processes. Ultimately, it is executive management's responsibility to approve the governance program and agree to the stewardship assignments of business information by data owners. Treadstone 71 is your key to building this bridge.

ISO17799, OCTAVE, CISSP, CISM, Sarbanes Oxley, SOX, CobiT, 27001, ISMS, ISO-27001, ISO 27001, ISO27001, 27005, 27002, GRC, prevention, 17799, proactive, FISMA, defense in depth, arabic, jihadi, cyber jihad, cyber terrorism, holistic security, 201 CMR 17, governance, risk, compliance, Jeff Bardin, Wireless Security, CMM, ITIL, ITSM, Sarbanes Oxley, security awareness, risk, threat, threat matrix, security metrics, ISO1779 training, 21 CFR 11, NSA IAM, BITS, risk management, security in the sdlc, secsdlc, security program, security strategy, business impact analysis, Treadstone 71, bourne, CISM, penetration testing, risk, GRC, detective controls, preventative controls, HIPAA, GLBA, Graham-Leach-Bliley, SAS 70, intrusion detection, interim CISO, interim CIRO, CIRO, CISO, chief security, FFIEC, financial services, trust, continuity, risk assessment, maturity, vulnerability scans, data classification, assessments, disaster recovery, homeland security, security metrics, rosi, roi, training, security posture, threat vulnerability pairs, vulnerability management, security services, information security, risk management, business risk, controls, holistic security, defense in depth, Governance, Risk and Compliance, information risk management