Data Governance and Classification is the formal framework of authority, policies, roles, and processes by which an organization manages its data assets throughout their lifecycle. Data governance establishes WHO holds decision-making authority over data, WHAT rules govern data handling, and HOW compliance with those rules is enforced and measured. Data classification is governance made operational: each data asset is assigned to a defined sensitivity tier—typically Public, Internal, Confidential, or Restricted—based on its regulatory context, business sensitivity, and potential harm from unauthorized disclosure, alteration, or loss. Together, they ensure the right people have the right access to the right data, with appropriate protections in place. Data governance (the policy and authority framework) is distinct from data management (the operational execution of storage, integration, and quality tasks)—a distinction ISACA specifically tests on the CISA exam.
Where it stops · what it isn't
- —IS: Policies, roles, classification schemas, accountability structures, and oversight mechanisms for data assets across their full lifecycle
- —IS: Integration of data classification with risk management, access control, and regulatory compliance programs
- —IS NOT: Data management operations (ETL, database administration, backup/recovery)—these are execution activities the framework governs, not governance itself
- —IS NOT: Information security controls alone (encryption, DLP tools)—these are enabling technologies that classification tiers require, not the governance framework
- —IS NOT: A one-time project—data governance is a continuous capability requiring sustained organizational commitment
- —IS NOT: Applicable only to regulated industries—any organization handling personal, financial, or proprietary data carries governance obligations
- —BOUNDARY: Data governance provides the structural framework within which legal counsel and compliance functions operate; it does not replace them
Connected concepts in the graph
Every cubelet sits in a knowledge graph. Here's what this one connects to.
PART OFGovernance and Management of IT (ISACA CISA Domain 2)
REQUIRESData Asset Inventory and DiscoveryEnterprise Risk Management (ERM)
ENABLESRegulatory Compliance (GDPR, HIPAA, GLBA, SOX, CCPA)Access Control and Identity ManagementData Retention and Lifecycle ManagementIncident Response and Breach Notification
RELATED TOIT Governance and StrategyInformation Security Governance
CONSTRAINSData Democratization and Analytics Access