Data Management
Implementation and audit guidance for secure handling of data across its lifecycle.
Guidance to Implement
Deploy centralized identity management (e.g.; Azure AD; Okta) to enforce user uniqueness and integrate with SaaS SSO where possible.
Guidance to Audit
Search for duplicate login patterns; account naming anomalies (e.g.; 'admin'; 'user1'); or reused credentials across users in SIEM and IAM systems.
Key Performance Indicator
X% of users use individual accounts for system access.
Guidance to Implement
Implement role-based access controls and perform periodic reviews of all access rights.
Guidance to Audit
Access control audit reports and review meeting minutes.
Key Performance Indicator
X% of employees have access according to their roles; with regular access reviews.
Guidance to Implement
Schedule annual reviews to assess and document user access rights.
Guidance to Audit
Annual review reports approved by the data owner.
Key Performance Indicator
X% of user access rights reviewed annually for compliance.
Guidance to Implement
Use anomaly detection; data provenance; and diversity checks before including any dataset in model pipelines.
Guidance to Audit
Maintain dataset validation reports and review version control for any training data updates.
Key Performance Indicator
X% of datasets are validated for quality and sanitized before use in AI models.
Guidance to Implement
Maintain a signed "Model Lineage Card" in the data-catalogue; update on every retrain.
Guidance to Audit
Verify card completeness; cross-check hash of training data vs. stored checksum.
Key Performance Indicator
X% of models and datasets have documented provenance for accountability.
Guidance to Implement
Tier 1: Accept only models from registries that support signed artifacts (e.g.; Hugging Face with TUF). Tier 2: For high-risk use cases; enforce reproducibility and SBOM traceability.
Guidance to Audit
Confirm registry enforcement; signed artifact settings; and verify a representative sample. Review exception logs for unsigned artifacts.
Key Performance Indicator
X% of datasets and models are verified for integrity using cryptographic checksums.
Guidance to Implement
Implement granular consent flags; propagate to feature store and model registry.
Guidance to Audit
Inspect consent database and lineage tags for a random 10 records.
Key Performance Indicator
X% of user consents are captured and linked to datasets used for AI training.
Guidance to Implement
Data‑curation pipeline enforces schema + policy; nightly scan flags violations.
Guidance to Audit
Review last scan report; confirm zero critical hits.
Key Performance Indicator
X% of data curations comply with schema and pseudonymization policies.
Guidance to Implement
Tag datasets with TTL; schedule deletion jobs; log hash of purged sets.
Guidance to Audit
Cross‑check 3 purged hashes against deletion ledger.
Key Performance Indicator
X% of datasets are tagged with TTL and automatically purged when expired.
Guidance to Implement
Define data quality metrics; automate validation pipelines; maintain quality scorecard.
Guidance to Audit
Sample training sets for quality issues; review rejection logs; test data validation gates.
Key Performance Indicator
X% of datasets used for AI models meet quality standards to reduce bias and errors.
Guidance to Implement
Integrate data ownership training into onboarding and require annual re-certification from data owners.
Guidance to Audit
Signed acknowledgment forms and training attendance records.
Guidance to Implement
Include data classification questions in regular assessments and address identified gaps with targeted training.
Guidance to Audit
Assessment results and remediation plans.
Guidance to Implement
Distribute detailed procedures for secure data handling and conduct regular training sessions.
Guidance to Audit
Procedure documentation and training logs.
Guidance to Implement
Regularly review and update the data retention policy and include it in mandatory training sessions.
Guidance to Audit
Policy distribution records and compliance audit reports.
Guidance to Implement
Implement approved data destruction methods and schedule periodic audits to verify compliance.
Guidance to Audit
Destruction logs and audit reports.
Guidance to Implement
Maintain a list of approved SaaS platforms and perform regular vendor security reviews.
Guidance to Audit
Vendor approval records and audit logs.
Guidance to Implement
Deploy application detection in endpoint agents and web gateways to flag unsanctioned AI tool use. Maintain an allowlist of approved AI platforms with controlled access.
Guidance to Audit
Analyze outbound connections and application usage reports to detect unauthorized AI platforms and correlate with departments or user roles.
Guidance to Implement
Implement an export approval process integrated with DLP tools to monitor and document data exports.
Guidance to Audit
Export approval logs and DLP reports.
Guidance to Implement
Enforce secure transmission protocols via network controls and conduct periodic audits.
Guidance to Audit
Protocol configuration records and audit logs.
Guidance to Implement
Develop social media usage policies that include security best practices and distribute them.
Guidance to Audit
Policy documents and training session records.
Guidance to Implement
Clarify acceptable use policies for personal email and cloud storage; monitor usage for compliance.
Guidance to Audit
Policy documents and usage logs.
Guidance to Implement
Implement DLP solutions to monitor data transfers and deliver clear training on data handling responsibilities.
Guidance to Audit
DLP reports and training attendance records.
Guidance to Implement
Review and document cross-border data transfer processes to ensure they meet all applicable regulatory requirements.
Guidance to Audit
Compliance audit reports and transfer logs.
Guidance to Implement
Deploy automated DLP tools to scan for unauthorized shadow data and schedule regular remediation reviews.
Guidance to Audit
DLP scan reports and remediation records.
Guidance to Implement
Utilize external monitoring services to detect unsanctioned copies of sensitive data and document findings.
Guidance to Audit
External monitoring reports and remediation actions.
Guidance to Implement
Implement comprehensive logging for all outbound data transfers and analyze logs for anomalies.
Guidance to Audit
Outbound transfer logs and review reports.
Guidance to Implement
Configure automated alerts based on predefined high-risk thresholds for data exports.
Guidance to Audit
Alert logs and threshold configuration documentation.
Guidance to Implement
Use automated checksum and hash validation tools integrated into backup and monitoring processes.
Guidance to Audit
Checksum logs and backup verification reports.
Guidance to Implement
Maintain detailed audit trails for changes to critical data assets and review them regularly
Guidance to Audit
Audit logs and review meeting minutes.
Guidance to Implement
Use automated data discovery tools to continuously update an inventory of sensitive data assets; review quarterly.
Guidance to Audit
Data inventory reports and audit logs.
Guidance to Implement
Use anomaly detection; data provenance; and diversity checks before including any dataset in model pipelines.
Guidance to Audit
Maintain dataset validation reports and review version control for any training data updates.
Guidance to Implement
Maintain a signed “Model Lineage Card” in the data-catalogue; update on every retrain.
Guidance to Audit
Verify card completeness; cross-check hash of training data vs. stored checksum.
Guidance to Implement
Tier 1: Accept only models from registries that support signed artifacts (e.g.; Hugging Face with TUF). Tier 2: For high-risk use cases; enforce reproducibility and SBOM traceability.
Guidance to Audit
Confirm registry enforcement; signed artifact settings; and verify a representative sample. Review exception logs for unsigned artifacts.
Guidance to Implement
Automate provenance capture in the ML pipeline (e.g.; DVC; MLflow). Store metadata in an immutable repository accessible to Risk & Compliance. Flag any asset whose lineage cannot be fully resolved.
Guidance to Audit
Review pipeline logs to verify that provenance records are generated for each new version. Spot-check metadata completeness (source URL; licence; checksums; approving owner).
Guidance to Implement
Integrate software-composition analysis (SCA) and AV scanning in CI/CD. Enforce allow-listing of trusted model registries. Reject package names not present in curated repositories.
Guidance to Audit
Review SCA reports for high-severity issues. Verify build logs show hash checks & signature validation. Spot-check blocked “hallucinated” packages.
Guidance to Implement
Enforce signature verification at ingestion. Maintain a list of trusted publishers & keys. Log/ block unsigned or unverified models.
Guidance to Audit
Inspect registry logs for unsigned download attempts. Check publisher-verification records & revocation handling.
Guidance to Implement
Implement granular consent flags; propagate to feature store and model registry.
Guidance to Audit
Inspect consent database and lineage tags for a random 10 records.
Guidance to Implement
Data‑curation pipeline enforces schema + policy; nightly scan flags violations.
Guidance to Audit
Review last scan report; confirm zero critical hits.
Guidance to Implement
Tag datasets with TTL; schedule deletion jobs; log hash of purged sets.
Guidance to Audit
Cross‑check 3 purged hashes against deletion ledger.
Guidance to Implement
Define data quality metrics; automate validation pipelines; maintain quality scorecard.
Guidance to Audit
Sample training sets for quality issues; review rejection logs; test data validation gates.