PM-23, Data Governance Body, tells you to establish a body made up of roles you define, with responsibilities you define. The statement leaves those parameters to the organization. It applies to federal systems and, by contract, to others. For a private company it is a model for who decides how data is handled.
What it means in practice
NIST says a Data Governance Body helps the organization keep coherent policies and balance the utility of data with security and privacy requirements. It sets policies, procedures and standards so that data, including personally identifiable information, is managed under applicable laws and guidance. Responsibilities can include guidelines for data modeling, quality, integrity and de-identification across the information life cycle.
The record also says the senior agency official for privacy has a role on this body.
Evidence to collect
- Charter listing the members and their roles
- Meeting calendar and minutes
- Data policies and standards the body has approved
- A decision log for data sharing and retention questions
Common gaps
- The body exists on paper and has never met
- Security and privacy are not represented
- Decisions are made in chat threads and never recorded
How to implement it
- Pick members from engineering, security, privacy, legal and the business.
- Meet monthly or quarterly and keep a short decision log.
- Publish the standards the group approves so teams can find them.
Quick check
What is the main job of the body?
To keep data policies coherent and balance data utility against security and privacy requirements.
