Governance, Risk, and Compliance · Topic 2 of 7
Data Governance and Classification
Cover data owners, classification labels, the data life cycle, retention, sanitization and how to treat production data in development and test.
- 5 min
- The data owner classifies data and approves access. The custodian applies the technical controls.
- Classification labels should trigger specific handling, such as encryption and sharing limits.
- Governance covers the whole life cycle, from collection through destruction.
What it is
Data governance sets the rules for how data is classified, used, kept and destroyed across its whole life. Security teams cannot protect everything equally, so classification tells them where to spend effort.
The exam tests whether you can match handling rules to data sensitivity, and whether you notice when real data ends up in a place it should not be.
How it works
Roles
| Role | Responsibility |
|---|---|
| Data owner | A senior person accountable for the data, who decides its classification and who may access it |
| Data steward | Keeps data quality and applies governance rules day to day |
| Data custodian | Runs the systems, applying the owner's controls such as backups and permissions |
| Data controller | Decides why and how personal data is processed (privacy law term) |
| Data processor | Handles personal data on behalf of a controller |
The owner decides and the custodian implements. A system administrator is usually a custodian, not an owner.
Classification
Classification assigns a sensitivity label so that handling rules can follow the label. A common commercial scheme runs from public to internal to confidential to restricted, and government schemes use their own names. The label should drive the controls: encryption, who may access, whether it may leave the network and how long it is kept.
Labels only work if the data is found first. A data inventory and data flow map show where sensitive data lives and moves, including copies in backups and cloud storage. Labelling can be manual, by the owner, or automated by tools that scan for patterns such as card numbers.
The data life cycle
Controls apply at each stage, not just during storage.
- Create or collect: collect only what you need (data minimization) and label it at once.
- Store: protect with encryption and access control.
- Use and share: apply least privilege and monitor for leakage.
- Archive: move older data to cheaper, controlled storage.
- Destroy: remove data when retention ends, using a method matched to its sensitivity.
Retention and legal hold
A retention schedule sets how long each kind of data is kept, based on law, contracts and business need. Keeping data longer than required raises breach exposure and legal discovery cost. Deleting it too soon can break a legal duty.
A legal hold overrides normal deletion when litigation or an investigation is expected. Affected data must be preserved until the hold is lifted, even if the schedule says to destroy it.
Sanitization
National Institute of Standards and Technology (NIST) Special Publication 800-88 describes three levels of media sanitization. Clear overwrites data using normal commands, purge makes recovery infeasible even with laboratory methods, and destroy physically ruins the media.
Cryptographic erase, which destroys the encryption key so the data cannot be read, is an accepted way to purge encrypted media. Choose the level from the data classification and whether the media will be reused.
Production data in development and test
A staging or test environment often gets a copy of production data so that tests are realistic. That copy carries the same legal duties as the original, yet it usually has weaker controls and more users. This is a classic exam scenario.
Safer options are shown below.
| Option | What it does | Trade off |
|---|---|---|
| Masking | Replaces sensitive values with realistic fake ones | Keeps format, loses true values |
| Tokenization | Swaps values for tokens, with the mapping held in a separate vault | Allows reversal only through the vault |
| Synthetic data | Generates artificial data with no real person behind it | Best privacy, may miss odd real world cases |
| Subsetting | Copies only a small slice | Reduces exposure but does not remove it |
Environments should also be separated: different accounts or networks, separate credentials, and no developer access to production by default. Code moves forward through development, test, staging and production through a controlled pipeline.
What to remember for the exam
- The data owner classifies data and approves access. The custodian applies the technical controls.
- Classification labels should trigger specific handling, such as encryption and sharing limits.
- Governance covers the whole life cycle, from collection through destruction.
- A legal hold suspends deletion even when the retention schedule says to destroy.
- Clear, purge and destroy are the three sanitization levels. Cryptographic erase counts as purge.
- Production data in test or development needs masking, tokenization or synthetic data.
- Data minimization means collecting and keeping only what you need.
- A data inventory and flow map must come before good classification.
If a scenario copies live customer records into a test system, the best answer replaces the data (mask, tokenize or synthesize) rather than just tightening access.
Common mistakes
Letting IT own the data. Technical staff run the systems, but the business owner is accountable for classification and access.
Retaining everything forever. Long retention feels safe but increases breach impact and discovery cost.
Assuming deletion equals sanitization. Deleting a file or formatting a disk may leave recoverable data, so pick the sanitization level that matches the label.
Forgetting copies. Backups, logs, exports and test databases hold the same sensitive data and need the same classification.
Check yourself
Work through these three questions.
Who decides how a data set is classified?
The data owner, who is accountable for the data. The custodian only applies the controls.
What should happen to scheduled deletion when litigation is expected?
A legal hold preserves the relevant data and overrides the retention schedule until it is lifted.
What is the safest way to give testers realistic data?
Use masked, tokenized or synthetic data instead of real production records.
Topic 2 of 7 in Governance, Risk, and Compliance
Test yourself on Governance, Risk, and Compliance
The full CompTIA SecurityX CAS-005 question bank has 654 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.