Archer-Ponemon Treaty for Data Governance

News & Updates

Ponemon Institute is pleased to announce the release of Flipping the Economics of Attacks, sponsored by Palo Alto Networks. In this study, we look at the relationships between the time spent and compensation of today’s adversaries and how organizations can thwart attacks. As revealed in this research, while some attackers may be motivated by non-pecuniary reasons, such as those that are geopolitical or reputational, an average of 69 percent of respondents say they are in it for the money.

...more

July 21, 2009, 4:10 pm

I’m still processing a lot of the information gathered, shared, and created during our 8^th RIM Renaissance this past weekend in Minneapolis. One of our sessions focused on the creation of an information governance “treaty” that holds various organizational members to a high standard (consistent with our RIM principles). Please review the following draft document and let me know what you think.

RIM Council Treaty on Information Governance

Draft V.1

[A.K.A. Archer-Ponemon Treaty project, created by the participations of the 2009 RIM Renaissance on 18 July 2009 in Minneapolis, Minnesota]

We the professionals, in order to establish and maintain a trustworthy secure enterprise that meets legal and regulatory requirements, customer expectations, and corporate vision, do hereby agree to the following:

· Establish commonly understood terms and clearly defined policies with respect to data protection, privacy and information security.

· Establish data protection and privacy principles that can be applied across the enterprise on a global basis.

· Establish an information governance body to achieve an all-inclusive, cross-functional approach to oversee the organization’s data protection, privacy and information security requirements.

· Establish a transparent mechanism for operational governance starting with a charter that is approved by the organization’s chief executive and other senior executives.

· Ensure the governing body is representative of the organization’s various information users.

· Ensure that representatives to the governing body are fully supported by their respective organizations or operating units.

· Strive to build data protection and privacy into the organization’s DNA by educating all employees as to why it is fundamentally important to the organization.

· Strive to create an information stewardship culture that fosters collaboration across the enterprise and diminishes silo thinking.

· Ensure this initiative is top-down, starting with the chief executive and the board.

· Empower the governing body to make difficult choices and take substantive action when necessary.

· Require the chair of the governing body to report to the organization’s chief executive with communication to the board of directors or audit committee when internal conflict arises.

· Establish and use objective metrics that define the organization’s performance in meeting data protection, privacy and information security objectives.

· Communicate to internal and external stakeholders, including regulators and supply chain partners, about the organization’s information governance approach in ways that do not compromise the program.

· Empower and reward employees to do the right thing with respect to their stewardship of information assets.

· Ensure the organization takes advantage of enabling technologies that improve the state of information security in an effective and cost efficient manner.

Comments

December 9, 2011 10:19am

Steven Adler

I like the idea of a DG Treaty. I've advocated charters in the past, which are similar in context but a treaty underscores the nature of the x-organizational agreement necessary to empower decision making.

The arguments in the treaty are quite ambitious and I wonder who will surrender the powers granted by those rights?

December 9, 2011 10:19am

Jay Libove, CISSP, CIPP

I suggest separating the "commonly understood terms" from the "clearly defined policies". Terms are something which, in theory at least, could be universally agreed upon within certain contexts (such as within an industry vertical). Policies, on the other hand, really must at times be company and even division specific.
I would include a (separate) commitment to "clear policies, comprehensible by their intended audiences".

The "information governance body" point leads me to ask, Who do we intend to ask to sign this treaty? I agree completely with the idea of this body; the only people whose signature on such an intention would really matter would be the executive board/ board of directors. (The "top-down" note later implies this; I would say it quite directly in the point about the governance body).

Other than that, I like it.
Jay Libove, CISSP, CIPP

December 9, 2011 10:18am

Fran Maier

Terrific event and work product by the group.
Let's include the importance of audit and 3rd party review.

Fran

News & Updates

Search

Archer-Ponemon Treaty for Data Governance

Comments