DATA 25 – Data Lifecycle Management (DLM)

What is this control really about?

This control is about tracking all the stages of the data life cycle. From the creation, to storage, use, sharing, archiving to destruction, data must be tracked and documented all the way through the phases.

This continuous exercise results in increased efficiency, increased security and helps meet relevant data privacy laws. DLM helps mitigate potential risks related to data collection, storage, or transmission. By implementing DLM, your company is better protected against ransomware, phishing, and other malicious attacks.

Any organization that handles sensitive, private data that’s subject to regulatory compliance should use DLM. If your business collects or stores information such as bank account numbers, contact information, healthcare-related data, etc., implementing DLM is critical.

Available tools in the marketplace

The following listing is “crowdsourced” from our customer base or from external research. TrustCloud does not personally recommend any of the tools below, because we haven’t personally used them. 

Available templates

TrustCloud has a curated list of templates internally or externally sourced to help you get started. Click on the link for a downloadable version:

• Externally sourced template from Boston university

What is required to implement this control?

First, a documented policy regarding the practice of managing data throughout its life is required. At a minimum, the policy should include:

• Data types
• Data flow map
• Data storage
• Data backup

Then, implement a process manual or automated to track all the phases. One way to do this is to track how information/data comes into the organization, which systems it passes through and where it is stored.

What evidence is the auditor looking for?

• Documented DLM policy
• DLM management tool

Artifact example

1. Documented DLM policy see template
2. DLM management report

   Here is a link to an example