Knowledge is Power

Sitewide Search

Search Bare Metal Cyber

Search exact control and technique identifiers, Cyber Wiki articles, framework records, playbooks, books, podcasts, Academy courses, individual lessons, and BMC Cyber Challenge activities.

Data governanceIntermediate

Master Data and the Source of Truth

Master-data management defines authoritative records for shared entities and governs how duplicates, conflicts, reference values, and downstream copies are resolved.

What it means

Master-data management defines authoritative records for shared entities and governs how duplicates, conflicts, reference values, and downstream copies are resolved.

Why it matters

Competing sources of truth create inconsistent identities, assets, products, and metrics, which can undermine access control, reporting, incident response, and executive decisions.

Practical focus

  • Define the scope, owners, acceptable risk, and required outcome for master data and the source of truth before choosing a tool or platform feature
  • Implement authoritative-source rules, stewardship, matching logic, survivorship decisions, and controlled synchronization through documented, reviewable configuration and change control
  • Collect duplicate rates, unresolved conflicts, synchronization failures, and source-authority decisions and compare the results with approved baselines, service objectives, and policy requirements
  • Exercise two systems issuing conflicting authoritative values for the same business entity as a planned test case, including detection, containment, rollback, escalation, and evidence retention

Common mistakes

  • Treating master data and the source of truth as a one-time technical setting instead of an operating control with owners and review cycles
  • Using default thresholds or broad exceptions without connecting them to business, privacy, security, and availability requirements
  • Keeping evidence in disconnected tools so reviewers cannot reconstruct who changed what, why it changed, or whether it worked
  • Testing only the normal path and discovering during an incident that two systems issuing conflicting authoritative values for the same business entity was never rehearsed

Certification relevance

This subject appears in or supports the following certification bodies of knowledge:

CompTIA Data+CompTIA DataSys+CompTIA DataX

Authoritative sources