What the framework covers, how it's structured, what changes for your team. Designed for async review across the department.
Data handling currently depends on team-level norms. Those norms vary across departments, and new hires inherit them without documentation. The company's regulatory obligations have expanded; the practices have not kept pace.
Every data asset the company holds falls into one of these categories. The tier determines the protections and response timeline, with accountability assigned at each level.
Health records, financial credentials, government-issued IDs. Exposure triggers mandatory reporting within 72 hours.
Unreleased financials, vendor contract terms, pre-board audit findings. No regulatory mandate but significant organizational damage.
Departmental planning docs, internal communications. Baseline encryption and standard access controls.
Press releases, published financials. Already through the approval process.
Every incident follows the same escalation path. The tier of the affected data determines the speed and scope of the response.
The framework separates governance decisions from implementation. Each role has a defined scope and a clear escalation path.
Sets classification policy for their domain. Accountable for regulatory compliance. Makes the final call during an incident.
Your first point of contact for any data question. Maintains access lists, runs quarterly reviews, coordinates with legal as needed.
Implements the controls. Manages encryption and access provisioning based on steward and owner directives.
The shift is structural. Individual judgment gets replaced by classification-driven protections with a defined escalation path.
The full technical reference is available on the governance wiki. Reach out to your department's data steward with questions.