D / Governance and compliance
Incidents rarely come from a spectacular attack. More often from a forgotten right, an untracked transfer, a backup never tested. We make data governance demonstrable.
D.1 / Approach
The business decides rights, IT applies them, security controls them, legal validates. We organise the whole and produce the evidence.
Data, owners, locations, flows and sensitivity levels.
Individual accounts, strong authentication, least privilege, periodic review.
Administration, sharing, transfers, encryption and key management.
Protected logs, access tests, restore drills.
Processing register, impact assessment, incident procedures.
D.2 / Results and commitments
Out of scope, by principle