DACO cheat sheet

Data governance is the exercise of authority and control over data assets: decision rights, accountability, and processes formalized through a governance operating model.

DAMA-DMBOK governance context diagram has three rings: data governance at the center, surrounded by data management functions, surrounded by environment elements (goals, principles, culture).

A RACI chart assigns each data decision to exactly one Accountable role; multiple Responsible roles are allowed, but multiple Accountable roles cause decision paralysis.

Data stewardship is the operational execution layer: stewards enforce standards defined by the governance council and escalate conflicts to it.

Data strategy components: vision, business case, guiding principles, prioritized initiatives, funding model, and success metrics tied to business outcomes.

Data valuation methods include cost-based (cost to obtain/store), market-based (comparable transactions), and income-based (expected future benefit).

Maturity models (e.g., CMMI-style levels 1-5) assess governance on capability areas: policy, organization, process, metrics, and tooling.

Data ethics principles commonly cited: fairness, transparency, accountability, privacy, and beneficence; they extend governance beyond legal compliance.

Policy hierarchy: policy (mandatory intent) > standard (specific requirement) > procedure (how-to steps) > guideline (recommended practice).

Three-schema architecture: external (user views), conceptual (business meaning), internal/physical (storage structures); mappings connect the levels.

Conceptual model entities and relationships are technology-independent; logical adds attributes and keys normalized to 3NF; physical adds indexes, partitions, and datatypes.

Normalization rules: 1NF removes repeating groups; 2NF removes partial key dependencies; 3NF removes transitive dependencies on non-key attributes.

Dimensional model: fact table holds measures and foreign keys; star schema has denormalized dimensions; snowflake schema normalizes dimensions into hierarchies.

Slowly changing dimension types: Type 1 overwrites, Type 2 adds a new row with version dates and current flag, Type 3 adds a prior-value column.

Kimball bus matrix maps business processes (rows) against conformed dimensions (columns) to plan incremental data marts.

Data Vault modeling uses hubs (business keys), links (relationships), and satellites (descriptive attributes with history).

Zachman framework classifies artifacts in a 6x6 grid: interrogatives (what, how, when, who, where, why) by perspectives (planner to operator).

TOGAF ADM phases: Architecture Vision, Business Architecture, Information Systems (Data and Application), Technology, Opportunities and Solutions, Migration Planning, Implementation Governance, Change Management.

ACID: Atomicity (all-or-nothing), Consistency (constraints preserved), Isolation (concurrent transactions do not interfere), Durability (committed data survives failure).

CAP theorem: a distributed store under a network partition must choose consistency or availability; partition tolerance is not optional in distributed systems.

BASE (Basically Available, Soft state, Eventually consistent) trades immediate consistency for availability in many NoSQL designs.

RAID levels: RAID 0 stripes without parity; RAID 1 mirrors; RAID 5 block striping with distributed parity (tolerates one disk loss); RAID 6 dual parity (tolerates two).

Backup types: full copies all data; incremental copies changes since the last backup of any type; differential copies changes since the last full backup.

Recovery metrics: RPO is the maximum acceptable data loss measured in time; RTO is the maximum acceptable downtime before restoration.

Database object types include tables, views, materialized views, indexes, sequences, synonyms, and stored procedures; each has distinct maintenance implications.

Capacity planning uses growth rate projections plus headroom thresholds; storage metrics include IOPS, throughput, and latency.

Database release management requires scripted, version-controlled migrations with rollback paths and test-environment validation before production deployment.

CIA triad: Confidentiality (only authorized access), Integrity (accuracy and completeness), Availability (accessible when needed).

Defense in depth layers controls across perimeter, network, host, application, and data; no single control is trusted alone.

Encryption states: at rest (stored media), in transit (TLS), in use (confidential computing); key management (rotation, escrow, separation of duties) is a distinct control.

Access control models: RBAC assigns permissions to roles; ABAC evaluates attributes of subject, resource, action, and environment; MAC uses labels and clearances.

Data masking types: static (persistent copy altered), dynamic (masked at query time), tokenization (surrogate replaces value, reversible via vault), and pseudonymization.

Privacy regulations: GDPR requires lawful basis, data subject rights, 72-hour breach notification, and DPO where applicable; CCPA/CPRA grants opt-out of sale and correction rights.

Data classification tiers (e.g., public, internal, confidential, restricted) drive handling rules: storage, transmission, retention, and destruction requirements.

Authentication factors: something you know, have, or are; MFA requires two or more distinct factor types, not two instances of one type.

Least privilege and segregation of duties limit blast radius; privileged access management controls administrative accounts with vaulting and session recording.

ETL extracts, transforms, then loads into the target; ELT loads raw first and transforms inside the target engine, leveraging its compute.

Extract patterns: full (snapshot), incremental (changes since watermark), and change data capture (CDC) reading logs or triggers for near-real-time deltas.

Batch vs. streaming: batch processes bounded datasets on schedule; streaming processes unbounded events with latency targets (seconds or less).

Message delivery semantics: at-most-once (may lose), at-least-once (may duplicate, needs idempotency), exactly-once (requires transactional guarantees end to end).

Idempotency makes reprocessing safe: applying the same message or file twice yields the same target state, typically via keys and upserts.

Data virtualization queries sources through an abstraction layer without moving data; federation combines results across heterogeneous sources.

Integration styles: point-to-point, hub-and-spoke, enterprise service bus, and publish-subscribe; coupling and fan-out grow with point-to-point links.

Canonical data model provides a shared representation to reduce N-to-N mappings to N-to-1, simplifying many-to-many integration.

API styles: REST uses resources and HTTP verbs; GraphQL lets clients request exact fields; gRPC uses typed contracts and efficient binary transport.

Data quality dimensions: completeness, accuracy, consistency, timeliness, uniqueness, validity, and (commonly added) integrity and precision.

Quality measurement: a metric is a rule plus a threshold; e.g., completeness = non-null records / total records, with an acceptable percentage target.

Root cause analysis for defects follows the data flow: source entry, extraction, transformation logic, and load; profiling localizes where values degrade.

Data profiling statistics: null counts, distinct counts, min/max, frequency distributions, pattern discovery, and cross-column dependency checks.

Analytics maturity ladder: descriptive (what happened), diagnostic (why), predictive (what will happen), prescriptive (what to do).

Data warehouse vs. data lake: schema-on-write with curated models versus schema-on-read with raw storage; lakehouse combines open storage with table formats and ACID.

Semantic layer defines shared metrics and dimensions so BI tools compute consistent numbers; without it, metric drift across reports is common.

Statistical caveats: correlation does not imply causation; sampling bias and survivorship bias distort conclusions; Simpson's paradox can reverse trends within subgroups.

Master data management ensures golden records for core entities (customer, product) via consolidation, deduplication, and stewardship workflows.