ISO/IEC TS 38505-3:2021
Information technology — Governance of data — Part 3: Guidelines for data classification
This document provides essential guidance for members of governing bodies of organizations and management on the use of data classification as a means to support the organization’s overall data governance policy and associated systems. It sets out important factors to be considered in developing and deploying a data classification system.
| Get this standard | Prices exclude GST | |
|---|---|---|
| PDF ( Single user document) |
$179.13 NZD
|
|
| HardCopy |
$214.78 NZD
|
|
| Networkable PDF |
Price varies
|
Foreword
Introduction
1 Scope
2 Normative references
3 Terms and definitions
4 Foundations
4.1 Context
4.1.1 The data deluge
4.1.2 The strategic value of data
4.1.3 The risks associated with data
4.1.4 Consequences of failure
4.2 Data classification
4.3 Purpose of classification:
4.4 Engage and empower staff
4.5 Structure of this document
5 Roles and responsibilities
5.1 General
5.2 Role of governing body
5.2.1 General
5.2.2 Understanding the role of data
5.2.3 Governance of data
5.2.4 Data classification approach
5.2.5 Data classification and risk management
5.2.6 Direct according to policy
5.2.7 Monitor conformance and performance
5.3 Role of management
5.3.1 General
5.3.2 Setting the scope of data classification
5.3.3 Propagating and implementing policy
5.3.4 Defining roles and responsibilities
5.3.5 Mobilizing the organization in support of the policy
5.3.6 Operation
5.3.7 Feedback from management to the governing body
5.3.8 Levels, discovery and attribution
5.4 Changing classifications
5.5 Defining the requirements: key considerations
6 Data classification framework
6.1 Context
6.2 Identification
6.3 Implementation
6.4 Monitor/Improve
7 Guiding principles
7.1 Simplicity
7.2 Default classifications
7.3 Interoperability
7.4 Equivalence
7.5 Use of data classification for processor and controller
7.6 Auditing, controls and compliance
7.7 Customer data
7.8 Assessment and reporting
7.9 Learning, maintaining and improving
7.10 Data protection
Bibliography
Keep me up-to-date
Sign up to receive updates when there are changes to this standard
Related Information
Similar Standards
-
AS/NZS 3802:1997
Data elements and interchange formats - Information interchange - Representation of dates and times
-
AS/NZS 5121:2015
Information technology - Vocabulary - Learning, education and training -
AS/NZS 5813.1:2012
Information technology equipment - Energy performance of computers - Part 1: Methods of measurement of energy performance -
AS/NZS 5813.2:2012
Information technology equipment - Energy performance of computers - Part 2: Minimum energy performance standards (MEPS) for computers
Foreword
Introduction
1 Scope
2 Normative references
3 Terms and definitions
4 Foundations
4.1 Context
4.1.1 The data deluge
4.1.2 The strategic value of data
4.1.3 The risks associated with data
4.1.4 Consequences of failure
4.2 Data classification
4.3 Purpose of classification:
4.4 Engage and empower staff
4.5 Structure of this document
5 Roles and responsibilities
5.1 General
5.2 Role of governing body
5.2.1 General
5.2.2 Understanding the role of data
5.2.3 Governance of data
5.2.4 Data classification approach
5.2.5 Data classification and risk management
5.2.6 Direct according to policy
5.2.7 Monitor conformance and performance
5.3 Role of management
5.3.1 General
5.3.2 Setting the scope of data classification
5.3.3 Propagating and implementing policy
5.3.4 Defining roles and responsibilities
5.3.5 Mobilizing the organization in support of the policy
5.3.6 Operation
5.3.7 Feedback from management to the governing body
5.3.8 Levels, discovery and attribution
5.4 Changing classifications
5.5 Defining the requirements: key considerations
6 Data classification framework
6.1 Context
6.2 Identification
6.3 Implementation
6.4 Monitor/Improve
7 Guiding principles
7.1 Simplicity
7.2 Default classifications
7.3 Interoperability
7.4 Equivalence
7.5 Use of data classification for processor and controller
7.6 Auditing, controls and compliance
7.7 Customer data
7.8 Assessment and reporting
7.9 Learning, maintaining and improving
7.10 Data protection
Bibliography