Data Governance and Frameworks
The Data Governance and Frameworks domain tests whether you can separate governance from management, place decision rights on the correct roles, and trace a policy statement down to a control an auditor can actually test. Scenario items usually describe an organisation with thick policy binders and no evidence of who decided what, or of whether the stated rule is operating.
Governance is decision rights, not documentation
Governance defines who is accountable for which decision, under what rules, and how performance is measured. Management executes those decisions. A data owner is accountable for a data domain - classification, access approval, quality thresholds, disposal. A data steward performs the operational work. Collapsing the two creates the classic failure where nobody can approve an exception.
Use the policy hierarchy deliberately: policy (mandatory intent, executive or board approved), standard (specific, measurable, enforceable requirement), procedure (step-by-step execution), guideline (advisory). Every policy statement needs an owner, an implementing control, a test method and a review cadence, otherwise it is unenforceable intent.
Frameworks you must be able to place
- NIST CSF 2.0 has six functions: Govern, Identify, Protect, Detect, Respond, Recover. Govern is the new function and is where data governance sits.
- ISO/IEC 27001 clauses 4–10 are mandatory management-system requirements; Annex A holds the control catalogue. ISO/IEC 38500 addresses IT governance at board level.
- The three lines model: operations own and manage risk, risk and compliance oversee, internal audit provides independent assurance.
- COBIT separates governance from management objectives; DAMA-DMBOK places governance at the centre coordinating the other data management knowledge areas.
Worked example
An audit finds that a retailer cannot show who approved access to its customer analytics warehouse. Reasoning: this is an accountability gap, not a tooling gap. Step one, define decision rights - who approves a new data domain, who signs classification, who accepts access exceptions, who owns retention. Step two, publish a policy with standards for classification, access and retention, each mapped to a control and an owner. Step three, charter a data governance council with membership, cadence and an escalation route. Step four, define two measurable indicators: percentage of critical data elements with a named accountable owner, percentage of access decisions with recorded evidence. Tooling comes last.
Traps that cost marks
Treating governance as a fixed-term project rather than a standing function. Assuming the CIO or IT owns all data. Accepting a vendor certificate as evidence that your control operates. Choosing activity metrics (meetings held) over outcome metrics (exceptions approved within SLA). Writing policy with no mapped control, which fails every audit test of operation.