Data Security Maturity Model
Alibaba Group
kepeng.lkp@alibaba-inc.com
Security Area
SAAG Working Group
DSMM
Draft
Data Security Maturity Model (DSMM) provides a multi-level maturity model
to help organizations to measure their data security capability maturity
level, identify issues related to data security capability, and improve
their data security capability.
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
document are to be interpreted as described in RFC 2119.
The overall goal of Data Security Maturity Model (DSMM) is to provide a multi-level
maturity model to help organizations solving the problems of data security management
in big data era, including:
How to build organizations data security capability
How to measure the data security capability maturity level of an organization
How to identify issues about data security capability
How to improve data security capability for organizations
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and
"OPTIONAL" in this document are to be interpreted as described in RFC
2119 [RFC2119].
The DSMM is a process management and improvement maturity model for the development
and management of data security services. It consists of best practices that address
the security issues in the lifecycle of data management from creation to delivery
and maintenance. The practices related to the DSMM model are extensible and
applicable to any organization objectives. The model presents an organized set of
practices and goals necessary for the data security.
The DSMM defines the requirements for organization responsibilities, institution
processes, technology tools, and staff skills, to ensure data security management
in the organizations. It does not describe how organizations must do something,
but rather what they must do in order to achieve high capabilities or maturity
of data security management. By providing a structured and standard framework of
practices, the DSMM can be used by organizations to build their own roadmap of
data security maturity management. The DSMM has an accompanying standardized
methodology for conducting objective appraisals of capability and maturity levels
within the organizations data security management practice.
The DSMM applies to all kinds of organizations, including industry enterprises,
governments and research institutes.
Data Security Maturity Model can be indicated by 5 levels, as described below:
Level 1: Performed Informally
Level 2: Planned and Tracked
Level 3: Well Defined
Level 4: Quantitatively Controlled
Level 5: Level 5: Continuously Improving
The high-level descriptions for data lifecycle are:
1) Data Creation: Data creation is the generation of new digital content, or
the significant alteration/updating of existing content, either structured or unstructured.
2) Data Usage: Data usage refers to the combination of a series of activities
towards active data.
3) Data Transmission: Data transition refers to the process that data flows from
one entity to another through the network.
4) Data Storage: Data storage refers to inactive data, which is stored physically
in any digital form.
5) Data Sharing: Data sharing refers to data exchanging between organizations,
customers and partners.
6) Data Destruction: Data destruction refers to the process of permanently or
temperately making the data unavailable using physical or digital means (e.g.,
crypto-shredding, freezing data under business context).
The DSMM model defines the organization capability in four dimensions, namely:
1) Organization Responsibilities: The first and most important capability
the organization should build is its data security organization, including its
function and responsibility, security consciousness. It addresses the need to
drive organizational data security management from the top down effort, and in
this way, organizations can be open and transparent, break down silos and get
internal teams to collaborate. It is important to get executive support, to
champion data security adoption from the top down.
2)Institution Process: This capability involves the creation of process.
This means that organizations need to put processes and frameworks in place
to operationalize data security management internally and externally. It enables
tight collaboration between different teams and entities like legal teams, IT,
Crisis PR, various business units and external business parties.
3)Technology Tools: Organizations have to invest in security technology
to facilitate the data security controls it employed, especially under current
big data era. Manual controls or management controls have been verified inefficient.
One of the challenges within this capability is that there are various technologies
available to choose thus organizations need to think strategically with proper
assessment before investing. Ensuring that the technology can scale and integrate
with existing applications that already exist in the enterprise is imperative.
4)Staff Skills: Organizations have to educate their staffs, to get more
security awareness training, and improve their security skills.
The DSMM model uses bottom-up method to assess and determine the data security
maturity level of an organization. Each domain in one data lifecycle phase should
be assessed and be given a single maturity level as the assessment result of the
domain. Then, take the minimum level of these domains as the assessment result
of the data lifecycle phase. Finally, the minimum maturity level of all 6 data
lifecycle phases is the overall maturity of the organization.
This draft does not require any IANA registrations.