How the Role of IT changes with Automated Data Risk Assessment
We know there are still a few IT folks out there that love being the hero after a stressful push for a major project. But most people in IT are sick of it; they want to get back to adding value to the business by proactively improving systems and ensuring everything runs smoothly operationally. However, the increasing drive to assess data risk for cyber resilience projects or regulatory compliance is not alleviating any of the burden falling on IT departments.
The good news is that there are more advanced enterprise data management platforms available that can automate data risk assessment and management so that IT doesn’t have to drop everything to perform a manual audit or scramble to identify and contain a data breach. Better yet, these solutions can see beyond what data owners know about their enterprise content and classify risk in unstructured data too. It’s time for IT to just say “no” to data risk projects (read: fire drills) and start proactively and continuously performing data risk management throughout the business.
How IT Traditionally Manages Data Risk Assessment Projects
Many organizations treat data risk assessment as an annual or semi-annual project. Typically, a point person is assigned to the project and their role is to contact the data owners from each business unit and ask them to gather their known information on what data they have and its perceived risk based on security and categorical tags. The entire process isn’t necessarily manual; IT often has traditional data management tools that they can utilize to audit the data they can see. They combine this with the data from the business units and the IT point person then absorbs all of that info and does their best to make sense of it and put it into a single report.
This isn’t a fun process for IT, nor for the data owners in the business units, but the report gets done and the box gets checked. Of course, when an official compliance audit happens, this whole process becomes a high-stress fire drill.
Sadly, this is the life of IT. But the really sad part is that this work is a total waste of time. Why? Because it’s not fully accurate and it’s rarely actionable for mitigating risk. The first problem is that the information is already out-of-date by the time it is reported.
But the even bigger problem is that the report is only on known data. It completely misses the true risk that is inherent in unknown, dark data – where sensitive information is often lurking.
How Unstructured Data Risk Can Be Surfaced with Enterprise Data Management
There are now advanced enterprise data management platforms that can discover unstructured data and bring it into the light for risk assessment and mitigation. Pre-trained AI is used to review and compare your unknown, unstructured data to known data types using advanced pattern matching. It can identify the document type and detect any sensitive information that should be flagged with a qualitative risk (high, medium, low) for security purposes. It can then apply metadata, document classification, or other identifying tags or labels to that unstructured data.
Modern enterprise data management platforms can also automate the classification of risk and calculate financial risk. With some configuration on the variables and assumptions in the calculation, the solution can assign a value to each content type and match that up to the financial liability of that data being lost or exposed. Automated actions (like re-classification, quarantine, re-provisioning, or archival) can then be taken to better secure the data and mitigate risk.
Perhaps the best part of these capabilities for IT is the fact that it is continuously monitoring risk and automating mitigation so there isn’t big project work to be done. And this data is readily available via dashboards and reports so the need for audit projects and cross-business risk assessments goes away completely.
What IT Can Do When They Automate Enterprise Data Management
By fully automating unstructured data risk assessment and mitigation, IT and data owners can change the job from gathering information and creating reports to instead focus on maintaining their systems and adding value. IT can get back to what they were hired to do instead of getting caught in fire-drill audits. One addition to their jobs will be reviewing the automated reporting and discussing if anything needs to be done proactively to mitigate risk.
And if an auditor does come asking for proof of compliance with data protection regulations, IT can easily provide holistic and granular reporting from their enterprise data management platform, showing their data management practices, current risk, and the work that has been done to make improvements. IT leadership can act with confidence as they always have a clear picture of their data risk and its financial implications.
Eliminating the fire-dill and moving from a project-based approach to data risk management that’s always-on will quell the fears of IT and business leaders, since there will be much less unknown risk to be worried about – and IT workers still get to be the heroes of the story after all.
