Risk Identification: Key Definitions
Last updated
Last updated
Data Assets
Data tables or data objects.
Security Risk or Breach Risk
Estimated security risk based on the type of Personal Information (PI/PII/Sensitive), size of the table, and extent of access privileges.
Risk Level - Breach Risk
Based on the calculated breach risk, we categorize the severity of breach risk into 4 types:
Severe
High
Medium
Low
Excessive Access Privileges
Good: Many users have access to the data asset, and more than 20% are active users.
Broad: Many users have access to the data asset, but only 5% to 20% of users are actively using the data.
Excess: Many users have access to the data asset, but less than 5% are active users.
Stale Data by Risk
Estimated risk based on the number of unused data assets in the past 90 days.
Privacy Risk Data
Estimated privacy risk of a data asset based on the type of personal data (PI/PII/Sensitive), size of the table, and activities.
Privacy Risk (Data Usage)
Estimated privacy risk of a data asset based on the type of personal data (PI/PII/Sensitive), size of the table, and activities in the past 90 days.
Risk level - Privacy Risk
V High: High risk of data privacy violations. The data likely contains PII and may not have the necessary controls or accountability.
High: Above average risk of data privacy violations. The data may contain PII and may not have the necessary controls or accountability.
Medium: Moderate risk of data privacy violations. The data may contain some personal data, likely non-identifiable.
Low: Low risk of data privacy violations.
Active Stale Infrequent
Active: Data assets that were accessed multiple times in the last 90 days.
Stale: Data assets that were never accessed in the last 90 days.
Infrequent: Data assets that were accessed once the last 90 days.
Activities Count
The number of times the data asset was accessed.
Data Catalog
The data governance team can view the list of data assets, where they can add consent, data subject type, data subject location, and tags for the data assets.
Purposes
The data governance team can add new purpose, data subject type, and consent so that it will get reflected in the Data Catalog page.
Data Governance / Compliance Manager
The governance team identifies risks and tracks governance metadata needed for compliance from data teams. Security team can login as governance manager to view high risk data, overexposed data and inactive access privileges.
Data – Business Owner
They provide the governance team with privacy and compliance metadata such as data subject type, location, retention, consent, etc.
Data Users, Applications
Users or applications that access and use the data.
Data Types
PI: Personal Information. You cannot identify the individual only with PI data (e.g., person country, DOB)
PII: Personally Identifiable Information. You can identify the individual with PII data (e.g., name, email)
Sensitive: e.g., race, genetics, religious preferences