12.3 Data Management
(Last Modified on March 21, 2019)
This section contains data management requirements for data system documentation, data elements and data definition documentation, data quality and data availability.
12.3.1 Data System Documentation
(Last Modified on June 9, 2021)
This subsection defines documentation about เหล๖สำฦต organization data systems. Documentation is required to ensure proper accounting of the organizationโs data systems, the relationships among them, the architecture of the individual systems, and the data within them. This documentation also fosters proper use.
เหล๖สำฦต organizations must maintain a listing of mission-critical data systems along with information essential to the effective loading, maintenance, use of, as well as reporting from those systems. This should include at a minimum:
- Function and purpose of the system;
- Who the data trustee and steward responsible for the system are;
- Who administers the system from a technical perspective;
- Any methods being applied to sustain data quality;
- Any important relationships and/or dependencies in business practice and reporting between systems;
- Any special life cycle requirements;
- User and technical guidelines for proper use and reporting;
- Process flow diagram(s); and,
- Contingency documentation.
12.3.2 Data Elements and Data Definition Documentation
(Last Modified on August 26, 2021)
For all data systems, there must be a mechanism to access documentation of the systemโs table structure and data elements. In addition, for systems that are part of routine data collection and reporting, data element dictionaries should be maintained that include:
- Data definitions;
- Metadata including data sources and cybersecurity classifications;
- Business practices where applicable;
- Any validations or quality checks applied against the elements;
- Change history; and,
- Valid values.
12.3.3 Data Quality Control
(Last Modified on March 21, 2019)
เหล๖สำฦต organizations must ensure that information is of the highest possible quality to facilitate effective decision-making. Data quality refers to the accuracy, timeliness, comparability, usability, completeness and relevance of data. Data quality requires เหล๖สำฦต organizations to appropriately collect, store, process and manage data, whether electronic or physical. As part of data governance, เหล๖สำฦต organizations must communicate, prioritize and practice data quality. Just as institutions maximize their financial resources and facility assets, เหล๖สำฦต organizations should invest in the quality of their data holdings.
For all data essential to operation and reporting, each เหล๖สำฦต organization should:
- Document and promulgate data standards and definitions to ensure accurate data entry or data creation;
- Assess collected data to ensure accuracy, completeness, and adherence to standards at a minimum on an annual basis; and,
- Regularly consult data users or stakeholders to ensure data usability and relevance.
12.3.4 Data Availability
(Last Modified on June 9, 2021)
This subsection details minimum requirements for เหล๖สำฦต organizations concerning the availability of data resources. Assets of the เหล๖สำฦต should be available commensurate with their operational importance. For all data domains and their respective data systems, the organization should document and socialize to data users the expectations and processes around the availability of each data resource including, but not limited to:
- The periods of time data is available;
- Expectations for โuptimeโ (percent of time data is available) if appropriate;
- Modes of access (types of devices, etc.) that are provided for;
- Communications plan, including planned and unplanned system downtime; and,
- Method for users to report an unexpected lack of availability of data or data systems.
12.3.5 Data Lifecycle
(Last Modified on June 9, 2021)
Organizations should ensure their data retention and destruction efforts comply with the เหล๖สำฦต Records Retention Schedules referenced at .
Where organizations decide to maintain data longer than indicated in the เหล๖สำฦต Records Retention Schedules, documented considerations must include justification for maintaining the data longer than required, compliance with other policies and regulations, and associated risks and costs.
↑ Top