Knowledge is Power

Sitewide Search

Search Bare Metal Cyber

Search exact control and technique identifiers, Cyber Wiki articles, framework records, playbooks, books, podcasts, Academy courses, individual lessons, and BMC Cyber Challenge activities.

Data governanceIntermediate

Data Lineage

Data lineage records how information moves from origin to destination, including transformations, joins, systems, owners, and reporting products.

What it means

Data lineage records how information moves from origin to destination, including transformations, joins, systems, owners, and reporting products.

Why it matters

Without lineage, teams cannot reliably determine which reports are affected by a bad source, whether a transformation changed meaning, or where sensitive data was propagated.

Practical focus

  • Define the scope, owners, acceptable risk, and required outcome for data lineage before choosing a tool or platform feature
  • Implement source-to-target mappings, transformation metadata, versioned pipeline definitions, and accountable stewardship through documented, reviewable configuration and change control
  • Collect lineage graphs, job histories, schema versions, source identifiers, and impact-analysis records and compare the results with approved baselines, service objectives, and policy requirements
  • Exercise an upstream source or transformation changing without downstream consumers being identified as a planned test case, including detection, containment, rollback, escalation, and evidence retention

Common mistakes

  • Treating data lineage as a one-time technical setting instead of an operating control with owners and review cycles
  • Using default thresholds or broad exceptions without connecting them to business, privacy, security, and availability requirements
  • Keeping evidence in disconnected tools so reviewers cannot reconstruct who changed what, why it changed, or whether it worked
  • Testing only the normal path and discovering during an incident that an upstream source or transformation changing without downstream consumers being identified was never rehearsed

Certification relevance

This subject appears in or supports the following certification bodies of knowledge:

CompTIA Data+CompTIA DataSys+CompTIA DataXCompTIA DataAI

Authoritative sources