Data Lifecycle Protection

[cgye]

Data owner needs to be determined.

Data owner needs to determine or be consulted in order to determine the following:

• Data classification
• Security controls to satisfy data classification
  • Access Control (who can have access to what resources, operations which can be performed, and accountability (i.e. logging & monitoring))
• Data Retention policy
• Data Archival policy
• Data Destruction policy