0420 Governance Controls¶

Governance is enabled through People, Process and Technology. These are controlled through a combination of technical controls (implemented IT function) and organizational controls (training, responsibility, buddy-checking etc).

GovernanceControl entity¶

A GovernanceControl entity is a GovernanceDefinition that describes how a particular GovernancePolicy should be implemented. For example, there may be a governance principle that personal data is only available to people with a legitimate need to know. One of the governance controls that support this principle could be the use of encryption on any storage device that holds personal data.

A governance control definition is intended to act as a requirement to implementors. So it may include details of the recommended encryption strength or approach to use. However, it does not detail exactly how to enable encryption on different technologies, or which storage unit that it applies to. The mapping of the governance control to the implementation is typically mapped through Governance Execution Points.

GovernanceMechanism relationship¶

A GovernanceMechanism relationship links a GovernancePolicy entity to a GovernanceControl entity that describes all or part of the implementation for the policy. The rationale attribute describes why this implementation approach was chosen.

GovernanceControlLink relationship¶

A GovernanceControlLink relationship links two related GovernanceControl entities together. The description attribute describes the reason for the relationship.

Raise an issue or comment below