Information governance: A framework for trustworthy public sector data management

In today’s complex and disruptive environment public organizations can use information governance strategies to maximize data insights while preserving trust.

Beyond the realm of business, data is arguably an equally important resource for the public sector as well. The challenge lies in striking a balance between leveraging data for positive gains and preserving data privacy in the process.

For governments across the world, the ability to harness public sector data will enable them to drive efficient planning, citizen engagement and economic growth.

Notably, trust is a critical element that will make or break the public sector organizations. The public will have peace of mind only if they are assured that their data is safeguarded and well protected. This calls for proper data management and information governance (IG) to enable public sector organizations to keep pace and secure their data from malicious cyberattacks. 

IG and data security

There are many formal definitions of IG. From an industry standpoint, we can define it as an accountability framework to ensure appropriate behavior in the valuation, creation, storage, use, archiving, and deletion of information.

IG encompasses a strategic and disciplined approach to maximize the value of data while minimizing the associated costs and risks. In this context, information is recognized as an organizational asset that requires high-level oversight and stewardship from the leadership team. In today’s complex and disruptive environment, IG can play a positive role as more and more public organizations embrace a whole-of-government approach to address mounting challenges and maximize the use of resources. Specifically:

• IG helps to break down silos and avoid any fragmentation in information management, enabling the public sector to make decisions based on the needs of organizations—eliminating the accidental decision makers who may lack the full visibility to formulate and execute the appropriate policies and actions.
• An effective IG policy will allow public sector organizations to create rules, standards, regulations and responsibilities geared towards keeping data safe and secure. For example, information policies help classify data, allowing organizations to scale risk as per the data types, and focusing on high security where it is required, locking their most important and confidential data from breaches. This is certainly very applicable to the public healthcare organizations that are vulnerable to cyberattacks due to their heavy reliance on data.
• As cybercriminals continue to get savvier and set their eyes on disrupting the ability of ordinary people to access critical services and goods, it is more critical than ever for the public sector to eliminate the risk exposure of public data.

To achieve this strong risk management, a sound IG framework should also outline the process of continuous monitoring, such as monitoring information access, measuring regulatory compliance adherence, conducting risk assessments, and maintaining adequate security.

Unlocking the value of data

IG enables organizations to extract value from their data assets. However, the ever-growing volume of data has impeded the ability of organizations to combat the data deluge and maximize the value of their data. For organizations that do not understand the types of data they handle and what value it has, it is no surprise they are unable to use or maintain data properly.

Adopting proper data management is a key factor for unlocking the full value of data.

• As a first step, public sector organizations will benefit from deploying proper classification tools and policies to understand what data they have and where it is located.
• It is also critical to set corporate procedures and policies related to data security, retention and disposal schedules, records management, information sharing, and privacy.
• As data custodians, it is equally vital for public sector organizations to establish how they operate and share information with their partners, stakeholders and suppliers to ensure compliance.

When it comes to implementing IG, insider threat is another key risk where employees could be the weakest link impacting data security—unintentionally or maliciously.

As such, it is also crucial to provide the necessary training for employees to ensure they comply with the IG policies and framework in place to equip them with the right skills to keep pace with the changing regulatory environment and the organization’s priorities.

Getting started with IG

A well-defined information governance framework needs to be aligned with organizational goals.

The best place to start an IG initiative is identifying a problem or pain point with information that requires addressing, or even an opportunity that reduces costs or enhances productivity.

Many tools are available to enable public sector organizations to handle information appropriately on their IG journey.  In today’s distributed and hybrid work environment, it is critical to make information assets and tools available to those who need it for various uses, including:

• Data management for effective storage, backup and recovery and data security
• Archiving and records management for data such as citizen information, staff records, or intellectual property
• Regulatory compliance audits and e-discovery
• Analysis to provide efficient and easy access to trending and historical data for strategic decision making

IG has the potential to bring significant benefits and value to public sector organizations, especially where more data is being collected and regulatory oversight increases.

With a sound strategy, the public sector can ensure data availability, control costs, mitigate cyber risks, and meet regulatory challenges—to win the trust and confidence of citizens.