What are individual responsibilities for protecting company data?

Protecting company data involves understanding data classifications and implementing appropriate security controls based on these classifications. Data classifications help a security team determine what data types can be released and what measures should protect each data type.

There are three main categories: 

• Confidential Data: This includes data that cannot be released and is protected by federal or state laws, regulations, or contractual agreements requiring confidentiality, such as Non-Disclosure Agreements (NDAs). 
• Protected Data: This data is not identified as confidential or public but still requires protection to ensure lawful or controlled release. 
• Public Data: This is data open to all users, with no security measures necessary. Public data includes information that must be made public due to obligations, such as fact sheets or information intended to promote the organization, research, or its initiatives. 

To ensure the protection of these data types, different roles and responsibilities are assigned within an organization: 

Data Owner: The Data Owner is assigned by management to oversee the handling of administrative, academic, or research data. They are responsible for ensuring appropriate steps are taken to protect data and for implementing policies, guidelines, and memorandums of understanding that define the proper use of the data. The Data Owner must: 

• Approve access and formally assign custody of information resources. 
• Specify appropriate controls, based on data classification, to protect information from unauthorized modification, deletion, or disclosure. 
• Ensure administrators implement these controls and educate users on their importance. 
• Confirm that applicable controls are in place and ensure compliance. 
• Re-evaluate access rights when a user’s access requirements change. 

Data Administrator: A dedicated team or an outsourced service provider is responsible for implementing the controls specified by the Data Owner. Their responsibilities include: 

• Implementing the controls and providing physical and procedural safeguards for the information resources. 
• Assisting Data Owners in evaluating the overall effectiveness of these controls. 
• Implementing monitoring techniques and procedures to detect, report, and investigate security incidents. 

Data User: Data Users are individuals authorized by the Data Owner to read, enter, or update information. Their responsibilities include: 

• Using the resource only for the purposes specified by the Data Owner. 
• Complying with the controls established by the Data Owner. 
• Preventing the disclosure of confidential or sensitive information.