Value, and the risk it brings

What the draft means by value

What the organisation learns from finding patterns in the data, and the business benefit that follows. The document calls it the most important characteristic. The definition sits in clause 3.1.15 and the risk it brings is described in the public clause 5.2, with the paired threats and controls in clause 6.7.

The risk the draft names

Insight worth stealing and worth manipulating, derived data sets that inherit weak access rules from the raw data, and a board metric that can be changed without a trace.

What to check in the estate

Treat the derived data set as an asset with its own classification and owner. Ask who can change the data behind a board metric, and what would reveal a change. Do not let access to the insight be a side effect of access to the platform.

What an auditor samples for value

• Asset entry for the derived data set
• Classification and owner
• Access rule for the insight
• Integrity check behind the metric

These are the artefacts that show the characteristic is managed, not only named. Name them before the audit, because an evidence list written afterwards is a description of what happened, not a control.

The definition in this draft

Wording tightened and the definition sourced. The characteristic itself is unchanged.

The clause behind the pairing is clause 6.7, and the definition is term 3.1.15. The wider change table is on the changes page.

Buy the kit, USD 799See the five free rows