Why Does Data Need Different Controls at Different Stages?
Data risk changes throughout its life, so protection is a lifecycle rather than a one-time setting.
Creation and collection
Determine what data is collected, why it is needed, how sensitive it is, and what legal or policy requirements apply.
Classification
Organizations can classify information as public, internal, confidential, highly restricted, or similar categories to drive appropriate safeguards.
Storage
Consider encryption, access controls, backups, location, and retention requirements.
Use and sharing
Users should have appropriate authorization and sensitive information should remain protected when moving between systems.
Retention and destruction
Keeping data forever can increase risk. Retention should match business and legal needs, and sensitive data should be securely destroyed when no longer required.
The takeaway
Data protection must follow the data from creation through destruction.
Related Summit guides
FAQ
Why classify data?
Different sensitivity levels require different safeguards.
Is keeping data forever safer?
No. Unnecessary retention can increase risk.
Does deleting a filename always securely destroy data?
No.