🔧 Chapter 07: Platform Comparison

Reference Standards

Governance is the difference between a catalog that drifts into uselessness and one that compounds in value. WIA-DATA-007 governance follows:

• ISO/IEC 38505-1:2017 — Governance of IT — Governance of data: principles, evaluate-direct-monitor model.
• ISO/IEC 38505-2:2018 — Implications of ISO/IEC 38505-1 for data management.
• ISO/IEC 27701:2019 — Privacy information management system extension to ISO/IEC 27001 and ISO/IEC 27002.
• ISO/IEC 27001:2022 — Information security management systems — Requirements.
• ISO/IEC 27018:2019 — Code of practice for protection of personally identifiable information (PII) in public clouds.

Roles and Responsibilities

The reference model assigns five roles using RACI semantics:

• Data Owner — Accountable for the asset's existence and lifecycle.
• Data Steward — Responsible for day-to-day quality, documentation, and access decisions.
• Data Custodian — Responsible for technical operation (storage, backup, security).
• Data Consumer — Informed party, may file feedback.
• Data Protection Officer — Consulted for personal-data and regulated assets.

Policy Enforcement

Each catalog asset carries machine-readable policy attributes (sensitivity_class, retention_days, allowed_jurisdictions, license_id) so downstream systems can enforce policy automatically. Policies are versioned, and the catalog records every policy change as a PROV-O activity for audit purposes.

Practical Application

Governance lives in policy, but it dies without instrumentation. Reference deployments treat governance as a feedback loop:

1. Policy as data. Every policy is encoded as machine-readable attributes on each asset (sensitivity_class, retention_days, allowed_jurisdictions, license_id), so downstream systems can enforce automatically rather than via PDF circulation.
2. Reviews on a calendar. Quarterly access reviews per ISO/IEC 27001 Annex A and annual data inventory reviews per ISO/IEC 27701 are scheduled events on the catalog itself, with completion telemetry visible to the data protection officer.
3. Incidents become improvements. Each governance incident produces a closed-loop entry: what attribute was missing, which policy was unclear, who is updating which template. The catalog's governance dashboard is, in effect, the management system required by ISO/IEC 38505-1.

This loop, far more than any single policy document, is what makes governance defensible to an external auditor.