CCDL1 cheat sheet

Data governance assigns decision rights and accountability for data assets; a framework documents the operating model, policies, standards, and escalation paths that make those rights enforceable.

Core RACI split: data owners are accountable for a domain's data, data stewards execute quality and definition work, custodians run the technical storage and processing controls, and the governance council arbitrates cross-domain conflicts.

A policy states intent and mandatory requirements; a standard sets measurable specifications; a procedure gives step-by-step execution; a guideline is recommended, not mandatory. Auditors test against policy and standard, not against guidelines.

Control categories: preventive (blocks the action), detective (identifies after the fact), corrective (restores), and compensating (substitutes when the primary control is infeasible). Every control needs an owner, frequency, evidence artifact, and test method.

A data domain or data product is a bounded, owned subject area with a named accountable owner, defined consumers, and published quality commitments; unowned data has no effective control.

Governance maturity typically progresses from ad hoc, to documented, to measured, to continuously optimized; maturity assessments score capability, not intent, and require evidence of operation.

Metadata types: business (definitions, glossary), technical (schemas, lineage, jobs), operational (run logs, freshness, row counts), and administrative (ownership, retention, access approvals).

A data governance KPI must be measurable and attributable, for example percentage of critical data elements with assigned owners, or percentage of policies with passing control tests in the last quarter.

Classification tiers are defined by impact of unauthorized disclosure, not by storage location; the same element carries the same tier wherever it is copied.

Typical tier ladder: Public, Internal, Confidential, Restricted (or a four-to-five level equivalent). Restricted covers regulated identifiers, credentials, health data, and authentication secrets.

A data element inventory records field-level name, definition, classification tier, source system, downstream consumers, and retention rule; a system inventory alone does not satisfy classification requirements.

Discovery workflow: automated scanning and pattern matching, then business validation of candidate elements, then tagging in the catalog, then control mapping per tier.

Sensitive data detection uses regex and dictionary matching for structured identifiers plus context checks (column names, neighboring fields) to cut false positives; validation rules such as checksum tests raise precision.

Handling matrix rule: each tier maps to required encryption, masking, access approval level, logging, and permitted sharing destinations. Absence of a tier mapping is a finding, not a default to Internal.

Data flow mapping must capture cross-border transfers, third-party recipients, and copies in backups, analytics sandboxes, and exports; shadow copies are the most common inventory gap.

Reclassification triggers include new regulation, new downstream use, contract change, or discovery of previously untagged sensitive fields; reclassification requires a documented approval record.

Lifecycle stages: create/acquire, classify, store, use and share, archive, and dispose. Each stage needs an entry criterion, an owner, and a control set.

Retention period is set by legal or contractual obligation, or by documented business need where no obligation exists; the longer of the applicable obligations governs.

Legal hold suspends deletion for named custodians and named data regardless of retention expiry; hold release must be recorded before disposal resumes.

Disposal methods: cryptographic erasure, verified overwrite, and physical destruction. Deleting a database row does not remove replicas, backups, or cached copies.

Archival moves data to lower-cost, lower-access storage while preserving retrievability within a defined restore time; archive is not equivalent to disposal.

Data minimization limits collection to what is necessary for the stated purpose; purpose limitation restricts later use to compatible purposes, and both must be reflected in retention schedules.

Lifecycle control evidence includes retention schedule versions, disposal certificates, hold registers, and restore test results; a schedule without disposal evidence is an untested control.

Aggregation and derived data inherit lifecycle obligations when re-identification is feasible; de-identified data with retained linkage keys is still personal data in most regimes.

Encryption at rest protects the storage medium; encryption in transit protects the channel. Key management (rotation, separation of duties, revocation) determines whether either control actually holds.

Tokenization replaces a value with a surrogate mapped in a protected vault; masking alters display but often retains reversibility; hashing is one-way but vulnerable to dictionary attack on low-entropy fields such as phone numbers.

Data residency controls require the storage region and the processing region to be verified separately; replication and disaster-recovery copies frequently violate residency assumptions.

Production data in non-production environments must be masked, synthetic, or de-identified with approved methods; direct production access from test systems is a segregation-of-duties failure.

Change control for data pipelines covers schema changes, transformation logic, and access grants; unlogged pipeline changes are a common cause of silent data exposure.

Processing integrity controls include input validation, reconciliation totals, duplicate detection, and job failure alerting; a completed job status is not evidence of correct output.

Backup controls require encryption, access restriction, restore testing at defined intervals, and immutability against ransomware or insider deletion.

Segregation of duties: the identity that can deploy pipeline code should not also hold the privilege to grant access to the resulting data stores.

Authentication verifies identity; authorization decides permitted actions. MFA is an authentication control and does not substitute for least-privilege authorization.

RBAC grants by role; ABAC grants by attributes such as department, classification, or purpose. ABAC scales better for fine-grained and context-dependent access but requires trustworthy attribute sources.

Least privilege and just-in-time elevation: standing administrative access is a finding; time-bound elevation with approval and automatic expiry is the preferred pattern.

Access review cadence: privileged and regulated-data access at least quarterly, standard access at least annually, plus review on role change and on termination.

Joiner-mover-leaver: access must be provisioned on approved request, re-evaluated on transfer, and revoked on the termination effective time; orphaned accounts are a recurring audit exception.

Service and machine identities need owners, scoped credentials, rotation, and inventory; shared or embedded credentials in code are a critical finding.

Segregation of duties conflicts include create-vendor plus pay-vendor, and grant-access plus review-access; conflicting combinations must be detected, not just documented.

Access decisions must be logged with subject, resource, action, decision, and timestamp; logs without the decision outcome cannot support an access investigation.

Incident phases: preparation, detection and analysis, containment, eradication, recovery, and post-incident review. Containment precedes full root-cause analysis.

Data incident severity is driven by data classification, volume, and exposure duration; a restricted-data exposure of any size typically meets the regulatory notification threshold.

Detection sources: DLP alerts, abnormal egress volume, failed-access spikes, privilege escalation, and unusual query patterns such as bulk export of a sensitive table.

Regulatory notification clocks start at awareness, not at confirmed root cause; GDPR-style regimes use 72 hours for supervisory notification, and contractual clocks may be shorter.

Evidence handling requires chain of custody, hashed copies, and write-once storage; log retention must exceed the longest investigation or legal-hold period.

Indicators of compromise for data incidents include new outbound destinations, credential use from anomalous geography, and mass-download jobs outside normal windows.

Post-incident review produces corrective actions with owners and due dates; recurrence of the same root cause indicates the corrective control was never validated.

Breach notification content typically requires nature of the incident, categories and approximate volume of data and subjects, likely consequences, and mitigation measures taken.

Core privacy principles: lawfulness and fairness, purpose limitation, data minimization, accuracy, storage limitation, integrity and confidentiality, and accountability.

Data subject rights commonly include access, correction, deletion, restriction, portability, and objection; each right needs a defined intake channel, identity verification step, and response deadline.

Legal bases for processing include consent, contract performance, legal obligation, vital interest, public task, and legitimate interest; consent must be specific, informed, and withdrawable.

A DPIA (data protection impact assessment) is triggered by high-risk processing such as large-scale sensitive data, systematic monitoring, or novel technology; it must precede processing.

Cross-border transfer mechanisms include adequacy decisions, standard contractual clauses, and binding corporate rules; the transfer mechanism must match the destination and the data category.

Privacy by design requires privacy requirements in the design phase; retrofitting controls after launch is a compliance gap even if the final state is compliant.

Record-keeping obligations require a processing register covering purposes, categories, recipients, retention, and security measures for each processing activity.

Role distinction matters: a controller determines purpose and means, a processor acts on documented instructions; joint controllership arises when purpose is jointly determined.

Quality dimensions: completeness, accuracy, consistency, timeliness, uniqueness, and validity. Each dimension needs an operational definition and a measurement rule.

A critical data element (CDE) is a field whose quality materially affects reporting, regulatory submission, or a key business process; only CDEs justify full control coverage.

Data quality rules are executable: null-rate thresholds, referential integrity checks, range and format validation, duplicate detection, and cross-field reconciliation.

Root-cause categories for defects: source entry error, pipeline transformation error, reference data drift, integration mapping error, and unauthorized manual override.

Data lineage supports integrity by tracing a reported value back to source and forward to consumers; without lineage, defect impact analysis is guesswork.

Quality thresholds should be tied to use: a 99 percent completeness target for a regulatory report differs from a 90 percent target for a marketing list.

Reconciliation controls compare independent sources, for example source-to-target record counts and financial control totals; matching totals do not prove record-level accuracy.

Data quality incident handling mirrors security incidents: detect, triage by CDE impact, remediate, and record corrective action to prevent recurrence.