Data Security Maturity Model

The overall goal of Data Security Maturity Model (DSMM) is to provide a multi-level maturity model to help organizations solving the problems of data security management in big data era, including: How to build organizations data security capability How to measure the data security capability maturity level of an organization How to identify issues about data security capability How to improve data security capability for organizations

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119 [RFC2119].

The DSMM is a process management and improvement maturity model for the development and management of data security services. It consists of best practices that address the security issues in the lifecycle of data management from creation to delivery and maintenance. The practices related to the DSMM model are extensible and applicable to any organization objectives. The model presents an organized set of practices and goals necessary for the data security. The DSMM defines the requirements for organization responsibilities, institution processes, technology tools, and staff skills, to ensure data security management in the organizations. It does not describe how organizations must do something, but rather what they must do in order to achieve high capabilities or maturity of data security management. By providing a structured and standard framework of practices, the DSMM can be used by organizations to build their own roadmap of data security maturity management. The DSMM has an accompanying standardized methodology for conducting objective appraisals of capability and maturity levels within the organizations data security management practice. The DSMM applies to all kinds of organizations, including industry enterprises, governments and research institutes.

Data Security Maturity Model can be indicated by 5 levels, as described below: Level 1: Performed Informally Level 2: Planned and Tracked Level 3: Well Defined Level 4: Quantitatively Controlled Level 5: Level 5: Continuously Improving

Figure 1 Model Framework

The high-level descriptions for data lifecycle are: 1) Data Creation: Data creation is the generation of new digital content, or the significant alteration/updating of existing content, either structured or unstructured. 2) Data Usage: Data usage refers to the combination of a series of activities towards active data. 3) Data Transmission: Data transition refers to the process that data flows from one entity to another through the network. 4) Data Storage: Data storage refers to inactive data, which is stored physically in any digital form. 5) Data Sharing: Data sharing refers to data exchanging between organizations, customers and partners. 6) Data Destruction: Data destruction refers to the process of permanently or temperately making the data unavailable using physical or digital means (e.g., crypto-shredding, freezing data under business context).

The DSMM model defines the organization capability in four dimensions, namely: 1) Organization Responsibilities: The first and most important capability the organization should build is its data security organization, including its function and responsibility, security consciousness. It addresses the need to drive organizational data security management from the top down effort, and in this way, organizations can be open and transparent, break down silos and get internal teams to collaborate. It is important to get executive support, to champion data security adoption from the top down. 2)Institution Process: This capability involves the creation of process. This means that organizations need to put processes and frameworks in place to operationalize data security management internally and externally. It enables tight collaboration between different teams and entities like legal teams, IT, Crisis PR, various business units and external business parties. 3)Technology Tools: Organizations have to invest in security technology to facilitate the data security controls it employed, especially under current big data era. Manual controls or management controls have been verified inefficient. One of the challenges within this capability is that there are various technologies available to choose thus organizations need to think strategically with proper assessment before investing. Ensuring that the technology can scale and integrate with existing applications that already exist in the enterprise is imperative. 4)Staff Skills: Organizations have to educate their staffs, to get more security awareness training, and improve their security skills.

The DSMM model uses bottom-up method to assess and determine the data security maturity level of an organization. Each domain in one data lifecycle phase should be assessed and be given a single maturity level as the assessment result of the domain. Then, take the minimum level of these domains as the assessment result of the data lifecycle phase. Finally, the minimum maturity level of all 6 data lifecycle phases is the overall maturity of the organization.

TBD

This draft does not require any IANA registrations.

TBD.

TBD