ADGM FSRA Information Technology Risk Management Guidance (VER01.201124) 8.2: Manage data across its lifecycle: identification and inventory, minimised collection, disciplined processing, classification-based controls, a storage and backup framework with restoration testing, governed use, transfer and sharing, and recorded destruction

What does 8.2 require?

A data lifecycle management framework sets policies, procedures and roles for each stage. Datasets generated and collected are identified at suitable junctures with accountability assigned, inventoried with type, form, acquisition channel, access, location and whether held internally or by third parties, and the inventory is reviewed regularly for necessity, quality, duplication and better acquisition; generation of sensitive data such as in logs is minimised by design and collection is limited to what objectives require. System development uses only necessary data with privacy and privilege protections maintained, and processing systems are resourced to meet performance needs without disruption. All data is classified by sensitivity and criticality with controls to match, for example encryption of confidential data in storage, use and transit, and classifications and policies are reviewed regularly. A storage framework covering operational and backup storage prescribes how datasets are stored, controls per classification, frequency, retention, archival and restoration testing; storage systems follow configuration standards and are patched; risk-appropriate storage controls such as encryption and masking apply across development, test and production at system, database and application level; high-availability storage mitigates corruption and single points of failure; archived data is segregated; and restoration tests are conducted and documented regularly. Policies govern use and transfer of classified data and sharing with internal and external parties such as aggregators and regulators, staff follow acceptable use with permissions and access controls on each system including collaboration tools, and classified data in transit is protected by secure transfer methods. Policies govern safe, secure and timely destruction of data internally and at third parties, with a record of data destroyed and the asset inventory updated.