Data Risk Management – Are there inadequacies in your organisation?

What is Data Risk Management?

Data risk management is how organisations handle; not only their data but the data of those outside of their organisation (perhaps their customers and suppliers), ensuring that the risks around storing that data is kept to a minimum. This involves regulating the way data is acquired, stored and used by your organisation whilst it is under your control. At the end of the data lifecycle – how to manage data removal in a safe and regulated way once it is no longer required.

These risks traditionally would fall within the boundaries of your organisation, however more likely now you would rely on a number of other services, all of which may have some of your organisations data. SaaS solutions are typically of this type where you may utilise a 3^rd party service to store or process information that you rely on for your business such as:

• Service Desk toolsets or CRM systems
• Cloud based HR Systems
• Online market places
• Cloud storage or hosting
• … and many more.

Data Security

Implementing a suitably secure solution, balancing your user needs and risk appetite is paramount to maintaining proper data risk management. However, when ineffective controls are employed, they can become the biggest and most costly causes of data risk. This can be in many forms, not simply cyberattacks which seem to get the most coverage.

Organisations must remain vigilant in order to have the correct processes involved to mitigate those risks. For example, a restrictive data sharing policy may be circumvented by a user utilised publicly available tool that might constitute a risk to your business (i.e. WhatsApp).

What are your biggest risks? Here’s a few:

• System breaches?
• Accidental transmission of data?
• Disgruntled Employees?
• Policy implementation / Procedures (Technical or not)?
• Endpoint controls?
• Unstructured data?
• Un-Encrypted data (where needed)?

Data Management

Mismanagement of data throughout each stage of its lifecycle can be an elevated risk. Data can be passed around and moved about frequently across a number of systems, software and other tools within an organisation, often being mishandled at one stage and ending up lost or unprotected. This can be particularly dangerous when handling data outside of your organisation.

This lack of control could also incur an expensive cost to your organisation and, in turn, result in a loss of productivity and unwanted reputation. Well managed data and correct processes ensure productivity, accuracy, cost efficiency, security and value to your business.

What are your biggest risks? Here’s a few:

• System breaches?
• Accidental transmission of data?
• Disgruntled Employees?
• Policy implementation / Procedures (Technical or not)?
• Endpoint controls?
• Unstructured data?
• Un-Encrypted data (where needed)?

Data Governance

Data governance refers to the policies an organisation has in place for the management of any data, internal or external. Businesses can end up with mismatched and disordered data if there is no robust data governance and can make regulatory compliance the proverbial nightmare. For example, under current General Data Protection Regulation (GDPR) standards, the right to be forgotten was introduced, which means:

‘An individual has the right to have their personal data erased if: The personal data is no longer necessary for the purpose an organization originally collected or processed it.’

The key point here is that you need to know what data you have, and where it is, how it is stored and how it has been processed. How can you guarantee that it has all been removed, leaving you open to financial and reputational scrutiny otherwise?

However, by looking at the bigger picture and adopting a more holistic approach to data risk management – ensuring all elements of your security are aligned- businesses can help minimise the internal and external risks at the same time.

Data risk management is not a static approach, it is dynamic and a constantly evolving reaction to changes that are made – whether they are in your control or not. For every new security software release, there is a change in the system with a chance of additional cyber security risks to the organisation if it is not reviewed and migrated correctly. The best data risk management strategies are ever evolving and those who monitor their processes and can make adjustments where necessary will ultimately better manage their data risks.

Read the next in our mini series… ‘Potential Data Risks and The Importance of Managing Them‘