What it means
A useful map includes systems, interfaces, vendors, purposes, categories, jurisdictions, retention, owners, and transformations such as enrichment or inference.
Why it matters
Organizations cannot reliably minimize, protect, retain, disclose, or delete data they cannot locate and understand.
Practical focus
- Assign owners for systems and data sets
- Map collection, use, sharing, storage, and disposal
- Include shadow systems and third parties
- Update the inventory through change and procurement processes
Common mistakes
- Inventorying applications but not data
- Documenting intended flows instead of actual flows
- Ignoring backups, logs, and derived data
- Treating the map as a one-time project
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: