Lesson 7 — Activity Flow, Policy, Standards & Access Design
The five activity families
The core Chapter 7 build sequence is:
- Identify Relevant Data Security Requirements
- Define Data Security Policy
- Define Data Security Standards
- Assess Current Security Risks
- Implement Controls and Procedures
Then continuously manage, monitor, comply, audit, and improve.
The sequence matters. Buying encryption software before identifying sensitive data, obligations, legitimate access, policy, and risk starts with a tool before knowing what the tool must accomplish.
Requirements first
Start with mission, strategy, industry, regulation, contracts, stakeholder expectations, business rules, and process touch points.
Useful artifacts:
- data-to-process matrices — where data is created/read/updated/deleted/executed in processes;
- data-to-role matrices — what operations roles actually need;
- central regulatory inventory — connect regulation → affected subject area → security-policy links → implemented controls.
Policy vs Standard vs Control vs Procedure
Policy
High-level direction / desired behavior.
Sensitive customer data must be protected from unauthorized access.
Standard
Detailed, measurable, testable rule that operationalizes policy.
Restricted Confidential access requires approved role membership and defined credential controls.
Control
Mechanism that enforces or detects compliance.
IAM blocks non-members and logs grants.
Procedure
Repeatable workflow for applying/managing the control.
Manager requests → Owner/Steward approves → IAM applies → quarterly review → revoke on transfer/termination.
Data Security Policy ownership
DMBOK distinguishes Enterprise Security Policy, IT Security Policy, and Data Security Policy. Data Security Policy is content-granular and should, in the chapter’s model, be:
- reviewed/approved by the Data Governance Council;
- owned/maintained by the Data Management Executive.
Where practical, keep it distinct enough from general IT Security Policy that data-specific requirements are not lost inside infrastructure rules.
Assess current risk before closing gaps
Compare actual sensitive assets, locations, entitlements, vulnerabilities, and controls to the required state. Typical gaps include unclassified data, stale/excessive access, weak audit evidence, uncontrolled copies, or unpatched components.
Source anchor: pp. 235–243.