Tag-Based Masking Meets a Legacy Schema
A company adopts tag-based masking: a tag PII_LEVEL with values HIGH/LOW drives a masking policy. Governance requires all columns containing PII to carry the tag. An audit finds 1,200 of 4,000 columns in the RAW database are untagged, including CUSTOMER.EMAIL and CUSTOMER.PHONE. The team wants to 'just tag everything in RAW as HIGH' to close the finding quickly. A data engineer warns this will break 30 downstream views that join on EMAIL for matching. The CISO wants the finding closed this sprint.
1. Evaluate the 'tag everything HIGH' proposal against the governance objective and the engineer's concern.
Read the worked answer
Tagging all of RAW as HIGH closes the finding on paper but defeats the control's purpose: a tag that is applied indiscriminately no longer distinguishes sensitive from non-sensitive data, so masking becomes either useless (everything masked, breaking analytics) or ignored (people request exemptions). The engineer's concern is real: masking EMAIL breaks joins used for matching, and blanket masking will cause a wave of exemptions that erode the policy. The governance objective is accurate classification, not tag coverage percentage. The correct move is to classify by data content/lineage, starting with the columns the audit named (EMAIL, PHONE) and the highest-risk schemas, and to track coverage as a metric that trends up - not to fake it in one sprint.
2. The CISO insists on closing this sprint. Propose a plan that satisfies the sprint deadline without creating the breakage the engineer predicts.
Read the worked answer
Split the finding into what can be closed now versus what needs a program. This sprint: (1) Tag the specific columns the audit named (EMAIL, PHONE, and any other confirmed PII) with PII_LEVEL = HIGH and attach masking - this addresses the concrete exposure. (2) For the 30 downstream views, grant the view-owning role an unmasked path via a dedicated role rather than exempting users, so matching still works while general access is masked. (3) Run a column-profiling scan (sampling for email/phone patterns) to produce a prioritized untagged list, and tag the top-risk schemas. Next sprints: complete classification of the remaining columns with a target date, and report coverage as a tracked metric. This closes the named risk now, avoids blanket masking, and gives the CISO a dated plan for the rest - which is a defensible closure, whereas 'tag everything HIGH' is not.