Risks mitigation and opportunities of information governance within ATNS
| Risks | Mitigation (control activities) | Opportunities |
|---|---|---|
| Loss of data, information, and intellectual property | To develop and implement policies and procedures that are aligned with the relevant legislation and ISO standards, clearly outlining the organisation's information, incorporate information ownership and data handling policies, and ensure proper backup procedures are in place and communicated org wide | Relevant, policies, procedure, and standards |
| Information lifecycle (creation of information to preservation or disposal) | To develop Standard Operational Procedures (SOP) on information lifecycle management (ILM) refers which will ensure that information from creation through to archiving or disposal is optimally used at a low cost and meet the legal compliance | Information lifecycle management SOP will provide the organisation with an overall information value chain and be able to manage the risks as information moves through the lifecycle and have an action plan to mitigate the risks |
| Lack of metadata management to increase findability, apply security, accessibility controls, and managing retention | The IT department will deploy and implement modern technology with metadata functionality. Train employees on basic metadata standards and requirements and why it is important to include metadata in the information that is saved in all organisational systems to ensure accessibility and retrievability | Quality control measures – easy access to information and searchability |
| Harm to information from malicious access and unauthorized persons | Access control policies and guidelines | Limit access based on the role of the employee and the responsibilities in the organisation. Create an audit trail. Eliminate security vulnerabilities by putting strict control measures in place |
| Storage of information in locations or formats that increase loss, cost and limited access | Strengthen security on all storage facilities by implementing the following
| Security control policies and procedures – that will limit unauthorised information access |
| Failure to preserve information relevant to litigation, compliance and government proceedings | Ensure that the information retention policy is in place with proper controls | Retention and e-Discovery policies |
| Outline e-discovery processes and communicate with businesses for proper implementation | ||
| Over-preservation of information relevant to litigation or government proceedings | ATNS will develop and implement the Information Retention and Archive Policy. The purpose of this policy will be to ensure that all information created in the organisation is monitored through its lifecycle and is disposed of or archived as and when required | Information Retention and Archive Policy |
| Disaster recovery | Evaluating the hazard, exposure, and vulnerability of the organisation's information. Planning ahead to ensure that any disaster that could occur should not destabilise the use and access of information for operational efficiency | Disaster Recovery Plan (procedure) |
| Information vulnerabilities that impacts data and information confidentiality, integrity, access, and availability | Implement information access control and permission control, activity monitor privileged information system users, implement Information Destruction Policy, training employees on information vulnerabilities, confidentiality, integrity, access, and availability | Information Destruction Policy |
| Training and awareness to all employees | ||
| Management of unstructured content, e.g. emails and correspondence | Training of all employees on enterprise content management (ECM) | ECM training |
| Any missing risk, specify | There were no comments on this section | Not applicable |
| Risks | Mitigation (control activities) | Opportunities |
|---|---|---|
| Loss of data, information, and intellectual property | To develop and implement policies and procedures that are aligned with the relevant legislation and ISO standards, clearly outlining the organisation's information, incorporate information ownership and data handling policies, and ensure proper backup procedures are in place and communicated org wide | Relevant, policies, procedure, and standards |
| Information lifecycle (creation of information to preservation or disposal) | To develop Standard Operational Procedures (SOP) on information lifecycle management (ILM) refers which will ensure that information from creation through to archiving or disposal is optimally used at a low cost and meet the legal compliance | Information lifecycle management SOP will provide the organisation with an overall information value chain and be able to manage the risks as information moves through the lifecycle and have an action plan to mitigate the risks |
| Lack of metadata management to increase findability, apply security, accessibility controls, and managing retention | The IT department will deploy and implement modern technology with metadata functionality. Train employees on basic metadata standards and requirements and why it is important to include metadata in the information that is saved in all organisational systems to ensure accessibility and retrievability | Quality control measures – easy access to information and searchability |
| Harm to information from malicious access and unauthorized persons | Access control policies and guidelines | Limit access based on the role of the employee and the responsibilities in the organisation. Create an audit trail. Eliminate security vulnerabilities by putting strict control measures in place |
| Storage of information in locations or formats that increase loss, cost and limited access | Strengthen security on all storage facilities by implementing the following Identity and access control Use of multi-factor authentication Use of strong passwords; and Remove unused storage space and ensure that the information lifecycle principles are implemented | Security control policies and procedures – that will limit unauthorised information access |
| Failure to preserve information relevant to litigation, compliance and government proceedings | Ensure that the information retention policy is in place with proper controls | Retention and e-Discovery policies |
| Outline e-discovery processes and communicate with businesses for proper implementation | ||
| Over-preservation of information relevant to litigation or government proceedings | ATNS will develop and implement the Information Retention and Archive Policy. The purpose of this policy will be to ensure that all information created in the organisation is monitored through its lifecycle and is disposed of or archived as and when required | Information Retention and Archive Policy |
| Disaster recovery | Evaluating the hazard, exposure, and vulnerability of the organisation's information. Planning ahead to ensure that any disaster that could occur should not destabilise the use and access of information for operational efficiency | Disaster Recovery Plan (procedure) |
| Information vulnerabilities that impacts data and information confidentiality, integrity, access, and availability | Implement information access control and permission control, activity monitor privileged information system users, implement Information Destruction Policy, training employees on information vulnerabilities, confidentiality, integrity, access, and availability | Information Destruction Policy |
| Training and awareness to all employees | ||
| Management of unstructured content, e.g. emails and correspondence | Training of all employees on enterprise content management (ECM) | ECM training |
| Any missing risk, specify | There were no comments on this section | Not applicable |
Sharing content requires targeting cookies to be enabled. Please update your cookie preferences to use this feature.