ISO/IEC 38505-1:2017

Information technology - Governance of IT - Governance of data - Part 1: Application of ISO/IEC 38500 to the governance of data

ISO/IEC 38505-1:2017 provides guiding principles for members of governing bodies of organizations (which can comprise owners, directors, partners, executive managers, or similar) on the effective, efficient, and acceptable use of data within their organizations by - applying the governance principles and model of ISO/IEC 38500 to the governance of data, - assuring stakeholders that, if the principles and practices proposed by this document are followed, they can have confidence in the organization's governance of data, - informing and guiding governing bodies in the use and protection of data in their organization, and - establishing a vocabulary for the governance of data. ISO/IEC 38505-1:2017 can also provide guidance to a wider community, including: - executive managers, - external businesses or technical specialists, such as legal or accounting specialists, retail or industrial associations, or professional bodies, - internal and external service providers (including consultants), and - auditors. While this document looks at the governance of data and its use within an organization, guidance on the implementation arrangement for the effective governance of IT in general is found in ISO/IEC/TS 38501. The constructs in ISO/IEC/TS 38501 can help to identify internal and external factors relating to the governance of IT and help to define beneficial outcomes and identify evidence of success. ISO/IEC 38505-1:2017 applies to the governance of the current and future use of data that is created, collected, stored or controlled by IT systems, and impacts the management processes and decisions relating to data. ISO/IEC 38505-1:2017 defines the governance of data as a subset or domain of the governance of IT, which itself is a subset or domain of organizational, or in the case of a corporation, corporate governance. ISO/IEC 38505-1:2017 is applicable to all organizations, including public and private companies, government entities, and not-for-profit organizations. This document is applicable to organizations of all sizes from the smallest to the largest, regardless of the extent of their dependence on data.

Technologies de l'information — Gouvernance des technologies de l'information — Gouvernance des données — Partie 1: Application de l'ISO/IEC 38500 à la gouvernance des données

General Information

• Status: Published
• Publication Date: 30-Mar-2017
• ICS: 35.020 - Information technology (IT) in general
• Technical Committee: ISO/IEC JTC 1/SC 40 - IT service management and IT governance
• Drafting Committee: ISO/IEC JTC 1/SC 40/WG 1 - Governance of InformationTechnology
• Current Stage: 9092 - International Standard to be revised
• Start Date: 09-Jun-2023
• Completion Date: 30-Oct-2025

Overview

ISO/IEC 38505-1:2017 - Information technology - Governance of IT - Governance of data (Part 1) is a high‑level, principles‑based ISO standard that applies the governance model of ISO/IEC 38500 to the governance of data. It provides guiding principles, a governance model and a common vocabulary for members of governing bodies to evaluate, direct and monitor the effective, efficient and acceptable use of data across the organization. The standard is applicable to public and private companies, government entities and not‑for‑profit organizations of any size.

Key topics and technical requirements

ISO/IEC 38505-1 is advisory (principles-based) rather than prescriptive. Key technical topics and areas of guidance include:

• Governance principles: Responsibility, Strategy, Acquisition, Performance, Conformance, and Human behaviour - applied to data governance.
• Governance model: Roles for the governing body to Evaluate, Direct and Monitor data-related decisions and outcomes.
• Data accountability map: Lifecycle-focused aspects such as Collect, Store, Report, Decide, Distribute, Dispose that help assign accountability and oversight.
• Data-specific aspects:
  • Value (quality, timeliness, context, volume) - ensuring data is fit for purpose.
  • Risk - classification schemes, security and risk management related to data assets.
  • Constraints - legal, regulatory, societal and organizational policy constraints affecting data use.
• Stakeholder assurance: Guidance to provide confidence to stakeholders that data use is governed appropriately.
• Vocabulary and definitions: Common terms (e.g., anonymization, big data) to support consistent governance language.

Note: ISO/IEC 38505-1 focuses on governance (policy, oversight and decision‑making). For implementation arrangements and operational controls for IT governance see ISO/IEC/TS 38501.

Practical applications - who should use it

• Governing bodies and boards seeking a structured approach to oversee data strategy, risk and compliance.
• Executive managers and C‑suite leaders who need to align data initiatives with corporate strategy and stakeholder expectations.
• Data governance teams, data protection officers and CIOs looking for a governance framework for data lifecycle oversight.
• Legal, audit and compliance teams, and external consultants or service providers advising on data risk, security and regulatory obligations.
• Helps organizations integrate data governance into corporate governance and IT governance processes, including cloud, IoT and big data scenarios.

Related standards

• ISO/IEC 38500 - Governance of IT (source principles and model).
• ISO/IEC/TS 38501 - Guidance on implementation arrangements for effective governance of IT.
• Other domain standards (data protection, security and quality) should be used to operationalize the governance outcomes defined by ISO/IEC 38505-1.

Keywords: ISO/IEC 38505-1:2017, governance of data, data governance standard, IT governance, data lifecycle, data accountability, data quality, data risk, data protection.

Standards Content (Sample)

INTERNATIONAL ISO/IEC
STANDARD 38505-1
First edition
2017-04
Information technology — Governance
of IT — Governance of data —
Part 1:
Application of ISO/IEC 38500 to the
governance of data
Technologies de l’information — Gouvernance des technologies de
l’information — Gouvernance des données —
Partie 1: Application de l’ISO/IEC 38500 à la gouvernance des données
Reference number
©
ISO/IEC 2017
© ISO/IEC 2017, Published in Switzerland
All rights reserved. Unless otherwise specified, no part of this publication may be reproduced or utilized otherwise in any form
or by any means, electronic or mechanical, including photocopying, or posting on the internet or an intranet, without prior
written permission. Permission can be requested from either ISO at the address below or ISO’s member body in the country of
the requester.
ISO copyright office
Ch. de Blandonnet 8 • CP 401
CH-1214 Vernier, Geneva, Switzerland
Tel. [phone]
Fax [phone]
[e-mail]
www.iso.org
ii © ISO/IEC 2017 – All rights reserved

Contents Page
Foreword .v
Introduction .vi
1 Scope . 1
2 Normative references . 1
3 Terms and definitions . 2
4 Good governance of data . 4
4.1 Benefits of good governance of data . 4
4.2 Responsibilities of the governing body . 5
4.3 Governing body and oversight mechanisms. 5
5 Principles, model and aspects for good governance of data . 5
6 Data accountability . 6
6.1 General . 6
6.2 Collect . 7
6.3 Store . 8
6.4 Report . 8
6.5 Decide . 9
6.6 Distribute . 9
6.7 Dispose .10
7 Guidance for the governance of data — Principles .10
7.1 General .10
7.2 Principle 1 — Responsibility .10
7.3 Principle 2 — Strategy .11
7.4 Principle 3 — Acquisition .11
7.5 Principle 4 — Performance .11
7.6 Principle 5 — Conformance .11
7.7 Principle 6 — Human behaviour .12
8 Guidance for the governance of data — Model .12
8.1 Applying the model .12
8.2 Internal requirements .13
8.3 External pressures .13
8.4 Evaluate .13
8.5 Direct .14
8.6 Monitor .14
9 Guidance for the governance of data — Data-specific aspects .15
9.1 General .15
9.2 Value .15
9.2.1 General.15
9.2.2 Quality .15
9.2.3 Timeliness.16
9.2.4 Context .16
9.2.5 Volume .16
9.3 Risk .16
9.3.1 General.16
9.3.2 Management .16
9.3.3 Data classification schemes .17
9.3.4 Security .17
9.4 Constraints .17
9.4.1 General.17
9.4.2 Regulation and legislation .17
9.4.3 Societal .17
9.4.4 Organizational policy .18
© ISO/IEC 2017 – All rights reserved iii

10 Application of the data accountability map .18
Bibliography .20
iv © ISO/IEC 2017 – All rights reserved

Foreword
ISO (the International Organization for Standardization) and IEC (the International Electrotechnical
Commission) form the specialized system for worldwide standardization. National bodies that are
members of ISO or IEC participate in the development of International Standards through technical
committees established by the respective organization to deal with particular fields of technical
activity. ISO and IEC technical committees collaborate in fields of mutual interest. Other international
organizations, governmental and non-governmental, in liaison with ISO and IEC, also take part in the
work. In the field of information technology, ISO and IEC have established a joint technical committee,
ISO/IEC JTC 1.
The procedures used to develop this document and those intended for its further maintenance are
described in the ISO/IEC Directives, Part 1. In particular, the different approval criteria needed for
the different types of document should be noted. This document was drafted in accordance with the
editorial rules of the ISO/IEC Directives, Part 2 (see www .iso .org/ directives).
Attention is drawn to the possibility that some of the elements of this document may be the subject
of patent rights. ISO and IEC shall not be held responsible for identifying any or all such patent
rights. Details of any patent rights identified during the development of the document will be in the
Introduction and/or on the ISO list of patent declarations received (see www .iso .org/ patents).
Any trade name used in this document is information given for the convenience of users and does not
constitute an endorsement.
For an explanation on the meaning of ISO specific terms and expressions related to conformity assessment,
as well as information about ISO’s adherence to the World Trade Organization (WTO) principles in the
Technical Barriers to Trade (TBT) see the following URL: www . i so .org/ iso/ foreword .html.
This document was prepared by Technical Committee ISO/IEC/JTC 1, Information technology,
Subcommittee SC 40, IT Service Management and IT Governance.
© ISO/IEC 2017 – All rights reserved v

Introduction
The objective of this document is to provide principles, definitions and a model for governing bodies to
use when evaluating, directing and monitoring the handling and use of data in their organizations.
This document is a high level, principles-based advisory standard. In addition to providing broad
guidance on the role of a governing body, it encourages organizations to use appropriate standards to
underpin their governance of data.
All organizations use data, and the major proportion of this data is stored electronically across IT
systems. With the advent of cloud computing, the realization of the potential of the “internet of things”
and the increasing use of “big data” analytics, data is becoming easier to generate, gather, store and
mine for useful information. This flood of data brings with it an urgent requirement and responsibility
for governing bodies to ensure that valuable opportunities are leveraged and sensitive data is protected
and secured.
This document has been prepared to provide guidelines to the members of governing bodies to apply
a principles-based approach to the governance of data so as to increase the value of the data while
decreasing the risks associated with this data. ISO/IEC 38500 provides principles and model for
the governing bodies of organizations to guide their current use and to plan for their future use of
Information technology (IT), and it is that document that is applied here.
As with ISO/IEC 38500, this document is addressed primarily to the governing body of an organization,
and will equally apply regardless of the size of the organization or its industry or sector. Governance
is distinct from management and thus we are concerned with evaluating, directing and monitoring the
use of data, rather than the mechanics of storing, retrieving or managing the data. That being said, an
understanding of some data management and techniques is outlined in order to enunciate the possible
strategies and policies that could be directed by the governing body.
vi © ISO/IEC 2017 – All rights reserved

INTERNATIONAL STANDARD ISO/IEC 38505-1:2017(E)
Information technology — Governance of IT — Governance
of data —
Part 1:
Application of ISO/IEC 38500 to the governance of data
1 Scope
This document provides guiding principles for members of governing bodies of organizations (which
can comprise owners, directors, partners, executive managers, or similar) on the effective, efficient,
and acceptable use of data within their organizations by
— applying the governance principles and model of ISO/IEC 38500 to the governance of data,
— assuring stakeholders that, if the principles and practices proposed by this document are followed,
they can have confidence in the organization’s governance of data,
— informing and guiding governing bodies in the use and protection of data in their organization, and
— establishing a vocabulary for the governance of data.
This document can also provide guidance to a wider community, including:
— executive managers,
— external businesses or technical specialists, such as legal or accounting specialists, retail or
industrial associations, or professional bodies,
— internal and external service providers (including consultants), and
— auditors.
While this document looks at the governance of data and its use within an organization, guidance on the
implementation arrangement for the effective governance of IT in general is found in ISO/IEC/TS 38501.
The constructs in ISO/IEC/TS 38501 can help to identify internal and external factors relating to the
governance of IT and help to define beneficial outcomes and identify evidence of success.
This document applies to the governance of the current and future use of data that is created, collected,
stored or controlled by IT systems, and impacts the management processes and decisions relating to data.
This document defines the governance of data as a subset or domain of the governance of IT, which
itself is a subset or domain of organizational, or in the case of a corporation, corporate governance.
This document is applicable to all organizations, including public and private companies, government
entities, and not-for-profit organizations. This document is applicable to organizations of all sizes from
the smallest to the largest, regardless of the extent of their dependence on data.
2 Normative references
The following documents are referred to in the text in such a way that some or all of their content
constitutes requirements of this document. For dated references, only the edition cited applies. For
undated references, the latest edition of the referenced document (including any amendments) applies.
ISO/IEC 38500, Information technology — Governance of IT for the organization
© ISO/IEC 2017 – All rights reserved 1

3 Terms and definitions
For the purposes of this document, the terms and definitions given in ISO/IEC 38500 and the
following apply.
ISO and IEC maintain terminological databases for use in standardization at the following addresses:
— IEC Electropedia: available at http:// www .electropedia .org/
— ISO Online browsing platform: available at http:// www .iso .org/ obp
3.1
anonymization
process by which personally identifiable information (PII) is irreversibly altered in such a way that a
PII principal can no longer be identified directly or indirectly, either by the PII controller alone or in
collaboration with any other party
[SOURCE: ISO/IEC 29100:2011, 2.2]
3.2
big data
data set(s) with characteristics (e.g. volume, velocity, variety, variability, veracity, etc.) that
for a particular problem domain at a given point in time cannot be efficiently processed using
current/existing/established/traditional technologies and techniques in order to extract value
Note 1 to entry: The term Big Data is commonly used in many different ways, for example as the name of the
scalable technology used to handle big data extensive datasets.
1)
[SOURCE: ISO/IEC 20546:— , 3.2.1]
3.3
cloud computing
paradigm for enabling network access to a scalable and elastic pool of shareable physical or virtual
resources with self-service provisioning and administration on-demand
Note 1 to entry: Examples of resources include servers, operating systems, networks, software, applications, and
storage equipment.
[SOURCE: ISO/IEC 17788:2014, 3.2.5]
3.4
data accountability
accountability for data and its use
Note 1 to entry: The “use” of data includes all activities associated with data.
3.5
de-identification
general term for any process of removing the association between a set of identifying data and the
data subject
[SOURCE: ISO/TS 25237:2008, 3.18]
1) Under preparation.
2 © ISO/IEC 2017 – All rights reserved

3.6
internet of things
IoT
global infrastructure for the information society, enabling advanced services by interconnecting
(physical and virtual) things based on, existing and evolving, interoperable information and
communication technologies
Note 1 to entry: Through the exploitation of identification, data capture, processing and communication
capabilities, the IoT makes full use of things to offer services to all kinds of applications, whilst ensuring that
security and privacy requirements are fulfilled.
Note 2 to entry: In a broad perspective, the IoT can be perceived as a vision with technological and societal
implications.
[SOURCE: Rec. ITU-T Y.2060]
3.7
machine learning
process using algorithms rather than procedural coding that enables learning from existing data in
order to predict future outcomes
3.8
pseudonymization
process applied to personally identifiable information (PII) which replaces identifying information
with an alias
Note 1 to entry: Pseudonymization can be performed either by PII principals themselves or by PII controllers.
Pseudonymization can be used by PII principals to consistently use a resource or service without disclosing their
identity to this resource or service (or between services), while still being held accountable for that use.
Note 2 to entry: Pseudonymization does not rule out the possibility that there might be (a restricted set of)
privacy stakeholders other than the PII controller of the pseudonymized data which are able to determine the PII
principal’s identity based on the alias and data linked to it.
[SOURCE: ISO/IEC 29100:2011, 2.24]
3.9
personally identifiable information
PII
any information that (a) can be used to identify the PII principal to whom such information relates, or
(b) is or might be directly or indirectly linked to a PII principal
Note 1 to entry: To determine whether a PII principal is identifiable, account should be taken of all the means
which can reasonably be used by the privacy stakeholder holding the data, or by any other party, to identify that
natural person.
[SOURCE: ISO/IEC 29100:2011, 2.9]
3.10
PII principal
natural person to whom the personally identifiable information (PII) relates
Note 1 to entry: Depending on the jurisdiction and the particular data protection and privacy legislation, the
synonym “data subject” can also be used instead of the term “PII principal”.
[SOURCE: ISO/IEC 29100:2011, 2.11]
© ISO/IEC 2017 – All rights reserved 3

4 Good governance of data
4.1 Benefits of good governance of data
Good governance of data assists governing bodies in ensuring that the use of data throughout an
organization contributes positively to the performance of the organization through:
— innovation in services, markets and business;
— appropriate implementation and operation of data assets;
— clarity of responsibility and accountability for both the protection and potential to add value;
— minimization of adverse or unintended consequences.
Organizations with good governance of data should be expected to be:
— trustworthy organizations for data owners and data users to transact with;
— able to provide reliable data for sharing;
— protectors of intellectual property and other value derived from data;
— organizations with policy and practice in place to deter hackers and fraudulent activity;
— prepared to minimize the impact of data breaches;
— aware of when and how data can be reused;
— able to demonstrate good data handling practices.
This document establishes principles for the effective, efficient and acceptable use of data. Governing
bodies, by ensuring that their organizations follow these principles, will be assisted in managing
risks and encouraging the exploitation of opportunities arising from the safe handling and accurate
interpretation of quality data.
Good governance of data also assists governing bodies in assuring conformance with obligations
(regulatory, legislation, contractual) concerning the acceptable use and handling of data.
This document establishes a model for the governance of data. The risk of governing bodies not
fulfilling their obligation is mitigated by giving due attention to the model in appropriately applying the
principles.
Inadequate provision for the governance of data can expose an organization to several risks including:
— penalties of not complying with legislation, especially legislation relating to required privacy
measures;
— loss of confidentiality of business data, e.g. recipes or design specifications;
— loss of trust from stakeholders, including business partners, customers and the public;
— inability to carry out critical organizational functions due to lack of trustworthy or business-
relevant data;
— increased competition through the strategic use of data by competitors.
Governing bodies can be held accountable for:
— breaches of privacy, spam, health and safety, record keeping legislation and regulations;
— non-compliance with mandated standards relating to security, social responsibility;
— matters relating to intellectual property rights.
4 © ISO/IEC 2017 – All rights reserved

4.2 Responsibilities of the governing body
Members of the governing body are responsible for the governance of data and are accountable for the
effective, efficient and acceptable use of data by the organization.
The governing body’s authority, responsibility and accountability for the effective, efficient and
acceptable use of data arise from its overall responsibility for governance of the organization, and its
obligations to its external stakeholders, including regulators.
The key focus of the governing body’s role in the governance of data is to ensure that the organization
obtains value from investments in data and associated IT, while managing risk and taking constraints
into account.
Additionally, the governing body should ensure that there is a clear understanding of what data are
being used by the organization and for what purpose, and that there is an effective management system
in place to ensure the obligations, such as data protection, privacy and respect for intellectual property,
can be met.
4.3 Governing body and oversight mechanisms
The governing body should establish oversight mechanisms for governance of data that are appropriate
to the level of business dependency on data.
The governing body should have a clear understanding of the importance of data to the organization’s
business strategies as well as the potential strategic risk to the organization from the use of that data.
The level of attention that a governing body gives to data should be based on these factors.
The governing body should ensure that its members and associated governance mechanisms (such as
audit, risk management and related committees) as well as managers have the requisite knowledge and
understanding of the importance of data.
The governing body may establish a subcommittee to assist the governing body in overseeing the
organization’s use of data from a strategic point of view. The need for a subcommittee will depend on
the importance of data to the organization and its size.
The governing body should ensure that an appropriate governance framework is established for the
governance and management of data.
The governing body should monitor the effectiveness of the mechanisms for the governance and
management of data by requiring processes such as audit and independent assessments to gain
assurance that governance is effective.
5 Principles, model and aspects for good governance of data
As ISO/IEC 38500 highlights, the governance of IT is a subset or domain of organizational governance, or
in the case of a corporation, corporate governance. This standard builds on and extends ISO/IEC 38500
to specifically examine data and its use by the organization.
ISO/IEC 38500 outlines six principles for good governance of IT, as follows:
a) responsibility;
b) strategy;
c) acquisition;
d) performance;
e) conformance;
f) human behaviour.
© ISO/IEC 2017 – All rights reserved 5

ISO/IEC 38500 also introduces a model for the governance of IT that establishes a cycle of “Evaluate-
Direct-Monitor”. This “EDM” model describes the three main tasks for governing IT and reminds us that
“Authority for specific aspects of IT may be delegated to managers within the organization. However,
accountability for the effective, efficient and acceptable use of IT by an organization remains with the
governing body and cannot be delegated.”
The broad areas of accountability as they relate to data are shown in Clause 6, along with the data flow
and “gating” process where strategy and policies are in place to support this accountability.
To apply the principles and model to the governance of data, it is necessary to examine data-specific
aspects of governance to the guidance. These aspects apply to all data and should be considered in
understanding data and its impact across the organization. They also highlight the opportunities that
the use of data (particularly with emerging technologies) provide to the organization, as well as the
extra accountabilities that data brings to the governing body.
The data-specific aspects of governance that are introduced in this document are the following.
— Value: Data is the raw material for useful knowledge. Some data may not be very useful, while other
data is extremely valuable to the organization. However, this value is not known until it is used
by the organization and therefore all data is of interest to the governing body that is ultimately
accountable for it. The term “Value” in this case also includes the quality and quantity of the data,
its timeliness, the context (which is in itself data) and the cost of its storage, maintenance, use and
disposal.
— Risk: Different classes of data bring different levels of risk and the governing body should understand
the risks of data and how to direct managers to manage these risks. The risks not only manifest in
data breaches, but also in the misuse of data as well as the competitive risks involved in not properly
utilizing data.
— Constraints: Most data comes with constraints on its use. Some of these are imposed externally
on the organization through legislation, regulation or contractual obligations and include issues
of privacy, copyright, commercial interests and so on. Other constraints on data include ethical
or societal obligations or organizational policies that restrict the use of the data. Strategies and
policies are required to account for these constraints in any use of the data by the organization.
Data and its use by organizations is becoming increasingly important for all organizations and their
stakeholders. By applying the principles, model and data-specific aspects of governance outlined in this
document, governing bodies should be able to take actions that maximize their investment in data use,
manage the risks involved and provide good governance for their organization.
6 Data accountability
6.1 General
Data is a key asset to any organization. It is used to keep track of the business (such as people, accounting,
inventory and so on) and as a raw material for knowledge, innovation and insight. The accountability
for data and its use rests with the governing body of the organization.
6 © ISO/IEC 2017 – All rights reserved

NOTE Like any model, this diagram is simplified in order to highlight specific concepts relating to items
of interest for the governing body. The titles of the elements give an indication of the activity and are further
explained below.
Figure 1 — Data accountability map
Figure 1 shows the areas of data accountability within an organization. The elements of the map are
further described below.
For any organization and for any business type, the map identifies the topics that are of interest from
a governance perspective. While the actual processes and implementations are the responsibility of
management, the lines indicate both data flow and gating mechanism where it is necessary to ensure
governance policies and strategies are in place and accountabilities can be met. The data-specific
aspects of governance in the context of these accountabilities are discussed further in Clause 9.
The focus of this document is the governance of data which should not be confused with the management
of data. Whereas the governing body is concerned with applying the principles of governance as outlined
in Clause 7, the field of data management has well-defined methods for the processing of data as well
as mechanisms for ensuring the confidentiality, integrity and availability of that data. An example data
management lifecycle is shown in Figure 2.
Create StoreProcess Archive Delete
Figure 2 — Example data management lifecycle
6.2 Collect
The Collect activity includes the data acquisition, gathering and creation process, learning from
previous decisions made and additional context extracted from other data sets (internal or external).
© ISO/IEC 2017 – All rights reserved 7

Data exists in many forms and can be created and collected for use by the organization in a number of
different ways, including the following.
— Data entry: Data entry is achieved using applications either within the organization [for example,
in an Enterprise Resource Planning (ERP) system or email application] or externally via a website,
mobile application or similar application.
— Transactions from other systems: Data entry or updating done on other systems can flow
through to the organization’s system through Electronic Data Interchange (EDI) or other interfacing
processes.
— Sensors: An increasing amount of data is ingested into the organization through machine systems
such as sensors. Sensors cover a wide range of data acquisition devices including web site logs,
social media sources and “internet of things” devices which include everyday devices from simple
temperature sensors to TVs, cars, traffic lights and buildings. Data from sensors can also include
potentially urgent signals such as alerts and alarms.
— New context: Data from reports can be combined with other data to provide additional information,
which is itself fed back into the data of the organization. In many cases, this additional data gives
new context to the original data and may need to be treated differently from the original data. New
contextual data can come from decisions which may give relevance or value to existing data.
— Subscription: Data may become available to the organization through a subscription to a data feed
or virtual data store.
6.3 Store
The Store activity includes locating the data where it can be physically or logically retrieved. This
includes data stored on devices owned and operated by the organization, devices external to the
organization and also virtual stores such as data feeds where the data is only collated when needed. In
each case, the stored data can be retained for reporting purposes pending a decision to dispose.
As data is collected through the above actions, it is ingested into a data store where it is secured and
managed and possibly archived. The amount of data that organizations control is increasing rapidly
due to new technologies such as the internet of things that use sensors to collect data, and big data
that uses large amounts of data to look for trends and make predictions using machine learning. Many
of these new technologies run in public cloud computing environments where the economies of scale
enable large storage and processing capabilities at much lower cost.
In some cases, the organization will use a data store that is outside its location. Traditionally, this has
been through offsite hosting operations where the storage is outsourced. Cloud computing takes this
to the next stage where the operation of the store is not visible to the client organization. Furthermore,
the organization may use a “virtual store” where data is provided only as a data feed which can flow
directly into reports or analysis.
It should also be noted that even though the organization may control the data in its store, it may not
“own” that data because of intellectual property rights such as copyright or other legal issues including
personal or health information handling laws. Special care may also be necessary where the storage
and use of data cross jurisdictional boundaries. In any case, the stewardship of the data remains with
the governing body.
6.4 Report
The Report activity includes manual or automated extraction and analysis of data for the purpose of
supporting decision making, distribution or disposal.
An important capability of an information system is to extract data from the data store in the form of a
data feed. This feed should have associated properties such as quality and currency of the data so that
the business can determine its usefulness to the reports they produce from that data.
8 © ISO/IEC 2017 – All rights reserved

During the extraction and reporting process, many data feeds may be used and these can come from
a data store within the organization or may come from a virtual data store outside the organization.
The combination of these data feeds may give a new context to the data. This new context is in itself
new data and this should be fed back into the data creation and collection process, where the normal
collection process occurs.
Applications can also produce reports as well as update the existing data and again, this new data
follows the creation process.
Other extraction and analysis techniques such as data mining and machine learning can be applied to
data to gain further insight, predict future outcomes and to make decisions automatically. Again, this is
new data being created and collected.
Reports can also be used to filter data to increase its usefulness, or to enable distribution and disposal.
For example, data from sensors can be aggregated to extract trends while removing personally
identifiable information through techniques such as anonymization and pseudonymization. The
original data can then be similarly extracted and disposed of.
6.5 Decide
The Decide activity occurs when a decision is made based on the report examination. The decisions will
be made by people within the organization or by automated means.
The main reason for having data is to make decisions, and the value of data is how it improves the
decisions that are made. Reports (including on screen reporting) are examined to provide information
upon which decisions are made.
Through a process of delegation, the governing body ensures that the decisions made are appropriate
for the level of responsibility of those decisions. This is of particular importance when decisions are
made automatically through simple data flow processes or more complex machine learning algorithms.
In any case, the governing body remains accountable for all decisions and should ensure that they have
the appropriate controls and, where necessary, apply human intervention to deal with any biases,
discrimination or profiling in the decision making process.
Because the decision making process values the data, that information (the “usefulness” of the data)
can be fed back into the data collection and creation process. By creating this data maintenance and
feedback loop, it is possible to fine tune the reports that are created, the data feeds that are used and
ultimately, the data that is fed into the system. Together, this loop increases the value of the decisions
made and that in turn can improve the business.
6.6 Distribute
The Distribute activity involves extraction or copying of data via the Report activity for circulation to
external parties.
Data may be extracted from the store and distributed outside the organization. This can occur for a
number of reasons, such as:
— external reporting is required for example to a government authority;
— it is part of a business-to-business (B2B) data exchange, customer use or similar activity;
— the data is being sold for example to an advertising agency or survey company;
— the data is part of the publishing business of the organization, for example business data (in other
words, the data is the product);
— the distribution was not authorized, in which case this would be classified as a data breach.
© ISO/IEC 2017 – All rights reserved 9

6.7 Dispose
The Dispose activity usually involves identifying data for disposal via the Report activity and then
permanently removing that data and any duplicates from the data store. In the case of a data feed, this
would be the permanent disconnection to that feed.
The increasing sophistication of data analysis, mining and learning tools increases the value of existing
data because more information can be extracted from more data. This fact, combined with the reduced
cost of keeping data reduces the necessity to dispose of data.
But there are still a number of reasons why some data should be extracted from the store (via the
Report activity) and securely disposed of.
— To reduce the risk of data leakage. If the data no longer exists, it cannot be inappropriately distributed
or used.
— To remove irrelevant or incorrect data. Although older data may be used for trend analysis, it may
no longer be relevant. Also, it may no longer be correct.
— To apply the right to be forgotten. Customers may ask to have their data removed.
— To comply with contractual arrangements with customers or suppliers.
— To comply with legal or regulatory requirements.
Similarly, there may be reasons such as health related regulations or legislation that require the
retention of data.
7 Guidance for the governance of data — Principles
7.1 General
ISO/IEC 38500 provides six principles for the good governance of IT. The following subclauses provide
guidance on how these principles can be applied to the governance of data.
The practices described are not exhaustive but provide a starting point for discussion of the
responsibilities of the governing body for the governance of data. That is, the practices described are
suggested guidance.
It is the responsibility of each organization, individually, to identify the specific actions required to
implement the principles, giving due consideration to the nature of the organization, and applying
appropriate analysis of the data-specific aspects referred to in Clause 9.
7.2 Principle 1 — Responsibility
The governing body is accountable for the responsibilities associated with the organization’s use of
data, and should ensure that those within the organization understand and accept their responsibilities.
These responsibilities:
— extend across the organization and beyond the IT function or department, or IT initiated activities;
— include key data related to business activities such as marketing, where data is used to inform
product plans, and product development, where data is collected to guide the design and build of
new products;
— include situations where the data itself is the product or service that the organization provides.
Such situations include content such as music or movies and information such as wea
...