What it means
Data provenance establishes the origin, custody, processing history, and authoritative context of a data item or dataset.
Why it matters
Provenance helps analysts distinguish trusted evidence from copied, stale, synthetic, or altered data and supports reproducibility, legal defensibility, and incident investigation.
Practical focus
- Define the scope, owners, acceptable risk, and required outcome for data provenance before choosing a tool or platform feature
- Implement persistent source identifiers, collection timestamps, transformation history, integrity checks, and custody records through documented, reviewable configuration and change control
- Collect hashes, signatures, source manifests, acquisition logs, and reproducible transformation records and compare the results with approved baselines, service objectives, and policy requirements
- Exercise a dataset losing its source context or being replaced without a verifiable history as a planned test case, including detection, containment, rollback, escalation, and evidence retention
Common mistakes
- Treating data provenance as a one-time technical setting instead of an operating control with owners and review cycles
- Using default thresholds or broad exceptions without connecting them to business, privacy, security, and availability requirements
- Keeping evidence in disconnected tools so reviewers cannot reconstruct who changed what, why it changed, or whether it worked
- Testing only the normal path and discovering during an incident that a dataset losing its source context or being replaced without a verifiable history was never rehearsed
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: