How to Get Started with Data Asset Inventory

Data Asset Inventory (DAI) is where you list and manage your Data Assets. You list all the places, physical and cloud, where you store data and what security you have implemented for the data's protection. This enables you to manage your data scans accurately and efficiently.

Overview

Spirion's data asset inventory uniquesly ties together

Data Asset Inventory (DAI) is where you list and manage your data assets
You list all the places, physical and cloud, where your organization stores data and what security you have implemented to protect your data
This enables you to manage your data scans accurately and efficiently
The information used in the SDV³ Dashboard helps you to assess the valuation and risk of your sensitive data and personally identifiable information (PII)

Initial Data Asset Inventory Set Up

To get started with Data Asset Inventory, do the following:

Add Assets to your Data Asset Inventory:
- This is where you list all the places your business keeps data, such as
- - Local, Physical Locations: Servers, laptops, workstations
  - Cloud-based: Dropbox, box, OneDrive, Google Drive, etc.
Add Targets to be scanned:
- These are the actual data that you want to discover and scan
- Both physical and cloud-based,
- Enables you to review the specific content of your data (like Social Security Numbers or Credit Card information).
Create and Run Scans:
- This is where you input the type of scans you want to run, based on your business needs.
- For example, a scan to review all of your SQL database Targets for new Social Security Numbers every 45 days or where do we store the Credit Card numbers we collect and what is their security?
Use SDV³ to evaluate your data risks and valuations:
- This is a visualization of the Value, Volume, and Vulnerability of your data that enables you to view overall risks and valuations and drill down into specifics to better understand your data risks and valuations based on your business needs.

Useful Definitions

The following are some definitions that are useful when working with your Data Asset Inventory and the SDV³ Dashboard.

See the following sections for more information:

Data Inventory

The following information can help you understand how a Data Inventory works:

Data Assets: This is the basic information about the asset.

Name
Type of asset
- For example: database, cloud storage, application
Administer

Organization: How the data is organized in response to regulation and other processes.

Regulation
Framework
Process and Policies, for example, ISO27001 or SOC-2 Type 2
Technical Security Measures: Remediation to protect or rectify information that is found on a Data Asset.

Data Asset Content: One or more Data Elements that document the type of asset data.

Data Elements: These are the actual pieces of information your company can store.

Personally Identifiable Information (PII)
Medical Information
Consumer Information
Marketing Information
Table and Field (resides within a database)

Classifications: Schemas used to understand and map Data Asset Content.

Business and Compliance Data Inventory

After collecting and recording Data Assets and their metadata, you are able to document the business context for each Data Asset and/or Data Asset Content.
Aids compliance with GDPR Article 30.

Process Information

Process Information documents the details of defined processes such as:

The actual process
Process owner
Purpose of processing
Defines if the process allows for CCPA sale of information.
This Process Information can then be related back to one or more Data Assets or Data Asset Content to help understand how the data is being used within your company and for what purpose. This helps you comply with various regulations such as CCPA and GDPR.
For each process, specifically CCPA, your organization may associate one or more Data Category to further refine and understand more about the process.
- Data Category can be Consumer, Health, and so on.
- Business owners can also identify for each process whether or not that process should automatically be included or excluded when doing Subject Request Fulfillment Requests.
- This will help streamline the processes for you by identifying up front which Data Asset and/or Data Asset Content will be reviewed as part of a Subject Request Fulfillment based on the Process defining the use of that Data Asset and/or Data Asset Content.
For each process, you can also identify one of more Legal Basis for Processing. You can select one or many Legal Bases, depending on the process and the regulation.

SDV³ Dashboard

The SDV3 dashboard provides actionable insights into you data security environment.

Learn How to Use the SDV3 dashboard.