CCDL1 study plan

Define each element of a data governance operating model (owners, stewards, custodians, council) and write a one-paragraph charter for a fictional organization.

Map at least six control frameworks and standards (for example NIST CSF, ISO/IEC 27001, COBIT, DAMA-DMBOK, GDPR accountability, SOC 2) to the governance functions each one addresses.

Draft a RACI matrix covering policy approval, classification decisions, access exceptions, and incident escalation.

List five governance metrics (policy exception rate, stewardship coverage, control test pass rate, and similar) and state how each would be measured.

Build a four-tier classification scheme (public, internal, confidential, restricted) with explicit handling rules per tier for storage, sharing, retention, and destruction.

Inventory at least 15 data assets in a register template that captures owner, system of record, classification, residency, retention period, and lawful basis.

Trace three data flows from source system to downstream consumer and mark every point where classification could change.

Identify five shadow-IT or unregistered data stores and describe how you would bring them into the inventory.

Apply the classification scheme to every asset in your register and resolve at least three disagreements between provisional and final tiers.

Define lifecycle stages (creation, storage, use, sharing, archive, destruction) and write entry and exit criteria for each stage.

Set retention schedules for each asset class and cite the business or legal driver behind each period.

Describe defensible deletion methods for structured, unstructured, and backup data, including how deletion is verified.

Design a storage and processing control set covering encryption at rest and in transit, key management, and separation of environments.

Compare control responsibilities across on-premises, IaaS, PaaS, and SaaS using a shared responsibility table.

Write three test procedures that would verify a storage control is actually operating, not just documented.

Draft a data residency and cross-border transfer decision tree for three jurisdictions.

Implement least-privilege role design for three job families and show where roles overlap or conflict.

Document the joiner, mover, leaver process with the access review checkpoint at each stage.

Compare authentication options (MFA, phishing-resistant credentials, SSO, privileged access management) and state which populations need which.

Write an access recertification procedure including reviewer selection, evidence retention, and remediation timelines.

Define five detection use cases (for example bulk export, anomalous privileged access, misconfigured public storage) with the log sources each requires.

Write an incident response runbook for a confirmed data exposure covering containment, notification decision, and evidence preservation.

Specify severity tiers and the escalation clock for each tier.

Identify the regulatory notification deadlines that would apply to a breach in your fictional organization and who decides to notify.

Map each asset in your inventory to its lawful basis, data subject rights obligations, and retention limit.

Draft a data subject access request workflow with intake, identity verification, search scope, and response timelines.

Compare obligations across two privacy regimes on consent, breach notification, and cross-border transfer, and note where they conflict.

Build a privacy impact assessment checklist for a new processing activity.

Define data quality dimensions (completeness, accuracy, timeliness, consistency, uniqueness, validity) with one measurable rule per dimension.

Design integrity controls for input validation, change logging, and reconciliation between systems of record and downstream copies.

Assemble a consolidated control register linking each domain's controls to the governance framework from week 1.

Complete a timed 60-question practice set and review every missed item back to its domain.

Write a one-page remediation plan for the three weakest domains identified in practice testing.