Data Governance: Practical Considerations For A Reasonable Security Program

Imagine receiving an email from an unknown actor claiming to have taken approximately 2 terabytes of data from your organization's network. The threat actor provides a file tree and sample files to substantiate its claim. The file tree appears to consist of your organization's entire network file share. You quickly scan the file tree and find HR files dating back to ... wait for it ... 2005. Putting aside flashbacks to the days of flip phones and the iPod nano, your first thought likely is "Why do we still have these files?"

Effective information governance is challenging for organizations of all sizes and all maturities. To quote the 2025 Data Security Incident Response Report (DSIR):