Risk Identification: Key Definitions

Here is a quick overview of the key definitions of Protecto.

General

Data Assets	Data tables or data objects.
Security Risk or Breach Risk	Estimated security risk based on the type of Personal Information (PI/PII/Sensitive), size of the table, and extent of access privileges.
Risk Level - Breach Risk	Based on the calculated breach risk, we categorize the severity of breach risk into 4 types: Severe High Medium Low
Excessive Access Privileges	Good: Many users have access to the data asset, and more than 20% are active users. Broad: Many users have access to the data asset, but only 5% to 20% of users are actively using the data. Excess: Many users have access to the data asset, but less than 5% are active users.
Stale Data by Risk	Estimated risk based on the number of unused data assets in the past 90 days.
Privacy Risk Data	Estimated privacy risk of a data asset based on the type of personal data (PI/PII/Sensitive), size of the table, and activities.
Privacy Risk (Data Usage)	Estimated privacy risk of a data asset based on the type of personal data (PI/PII/Sensitive), size of the table, and activities in the past 90 days.
Risk level - Privacy Risk	V High: High risk of data privacy violations. The data likely contains PII and may not have the necessary controls or accountability. High: Above average risk of data privacy violations. The data may contain PII and may not have the necessary controls or accountability. Medium: Moderate risk of data privacy violations. The data may contain some personal data, likely non-identifiable. Low: Low risk of data privacy violations.
Active Stale Infrequent	Active: Data assets that were accessed multiple times in the last 90 days. Stale: Data assets that were never accessed in the last 90 days. Infrequent: Data assets that were accessed once the last 90 days.
Activities Count	The number of times the data asset was accessed.
Data Catalog	The data governance team can view the list of data assets, where they can add consent, data subject type, data subject location, and tags for the data assets.
Purposes	The data governance team can add new purpose, data subject type, and consent so that it will get reflected in the Data Catalog page.

User Types

Data Governance / Compliance Manager	The governance team identifies risks and tracks governance metadata needed for compliance from data teams. Security team can login as governance manager to view high risk data, overexposed data and inactive access privileges.
Data – Business Owner	They provide the governance team with privacy and compliance metadata such as data subject type, location, retention, consent, etc.
Data Users, Applications	Users or applications that access and use the data.

Data Types

Data Types	PI: Personal Information. You cannot identify the individual only with PI data (e.g., person country, DOB) PII: Personally Identifiable Information. You can identify the individual with PII data (e.g., name, email) Sensitive: e.g., race, genetics, religious preferences