Data Life Cycle Management (DLCM) is the structured governance of data from creation or acquisition through active use, storage, archival, and final disposal — with risk controls integrated at every phase. In the ISACA CRISC framework, DLCM is an end-to-end operational discipline, not a single policy or tool. It ensures data is classified, protected, retained only as long as necessary, and destroyed in a verifiable, auditable manner. The seven canonical phases are: (1) Creation/Acquisition, (2) Classification, (3) Storage/Protection, (4) Active Use/Sharing, (5) Retention, (6) Archival, and (7) Disposal/Destruction. Risk management runs as a horizontal control layer across all seven phases — it does not concentrate only at creation or disposal. DLCM is distinct from data backup strategy, data quality management, master data management (MDM), and database administration, though each intersects with it.
Where it stops · what it isn't
- —IS: Governance of data from creation to destruction, including classification, retention schedules, and secure disposal procedures
- —IS: Risk-integrated controls applied at each lifecycle phase — access control, encryption, monitoring, and disposition verification
- —IS: A policy framework spanning on-premises, cloud, SaaS, and hybrid environments
- —IS NOT: Data backup and recovery strategy — backup is one storage mechanism within the lifecycle, not the lifecycle itself
- —IS NOT: Data quality management or master data management (MDM) — DLCM governs existence and access, not accuracy or deduplication
- —IS NOT: Database administration or schema management — DLCM operates at the governance layer above infrastructure
- —IS NOT: A one-time compliance project — DLCM is a continuous operational discipline with recurring review cycles
- —IS NOT: Limited to structured data — DLCM applies equally to unstructured data: emails, documents, media files, and SaaS records
Connected concepts in the graph
Every cubelet sits in a knowledge graph. Here's what this one connects to.
PART OFInformation Technology and Security (CRISC Domain 4)
REQUIRESData ClassificationAccess Control Management
ENABLESIT Operations ManagementRegulatory Compliance Management (GDPR, HIPAA, SOX, CCPA)Incident Response and Forensic Readiness
RELATED TOInformation Security ControlsThird-Party Risk Management
CONSTRAINSCloud Storage and Multi-Environment ArchitectureAI/ML Training Data Governance