What DQ-1220 Questions and Answers feature?

Effective security risk reduction begins by understanding what data exists, how sensitive or critical it is, and where it resides. A classification model provides this foundation by classifying data concepts according to protection requirements and linking those concepts to their physical implementations. The certification material reflects this DAMA principle directly.

Data cannot be protected proportionately if the organization does not know whether it represents public information, internal operational information, personally identifiable information, financial data, intellectual property, regulated information, or another sensitive category. Classification allows the organization to apply appropriate controls according to risk rather than treating every data asset identically.

Once classification is established, security teams can define access requirements, encryption needs, monitoring, retention controls, masking, authorization policies, and other safeguards. Metadata is essential because classifications must ultimately be connected to actual databases, files, attributes, interfaces, and repositories.

A firewall alone does not provide data-level protection, and role classification by itself addresses only one dimension of security. Similarly, an Enterprise Data Model describes organizational data structures but does not replace security classification.

Reference Topics: DAMA-DMBOK2 Chapter 7 — Data Security; Data Classification; Risk Reduction; Sensitive Data Discovery; Metadata Management; Chapter 13 — Integrity and Controlled Use.

===============

The correct answer is storage is cheap and easily expanded. DAMA-DMBOK2 discusses retention and disposal as important lifecycle-management responsibilities. Although information that no longer provides business, legal, regulatory, historical, or evidentiary value should normally be disposed of according to approved retention policies, organizations often postpone disposal because modern storage appears inexpensive and technically easy to expand.

This reasoning is deceptive. The acquisition cost of storage is only one component of total information-management cost. Retaining unnecessary information also increases backup requirements, recovery time, discovery obligations, privacy exposure, security risk, metadata-management effort, migration complexity, and the volume of information that must be governed. DMBOK2 therefore stresses that non-value-adding information should not be retained merely because storage capacity is readily available.

From a Data Quality perspective, excessive retention also increases the population of obsolete, redundant, and potentially inconsistent information. This makes profiling, lineage analysis, master-data reconciliation, and authoritative-source identification more difficult.

A sound governance program consequently combines retention schedules, legal requirements, metadata classification, defensible disposal procedures, and clear accountability so that data is retained for legitimate reasons rather than technological convenience.

Reference Topics: DAMA-DMBOK2 — Document and Content Management; Retention and Disposal; Information Lifecycle; Data Governance; Chapter 13 — Data Quality and Obsolete Data.

===============

Critical Data Elements are identified so that organizations can concentrate governance and Data Quality effort where failure would create the greatest business impact.

Not every attribute deserves the same level of profiling, monitoring, stewardship, lineage documentation, control, and remediation. Applying identical controls to every field would usually be economically inefficient and may divert resources away from information that supports regulation, financial reporting, key operations, customer outcomes, or strategic decisions.

The DMBOK2 maintenance revision explicitly adds and clarifies the concept of a Critical Data Element within Chapter 13.

Once a CDE is identified, the organization can define applicable quality dimensions, measurable rules, thresholds, ownership, authoritative sources, lineage, issue escalation, and monitoring frequency.

Criticality is contextual. An attribute may be critical to one process and relatively insignificant to another. The decision should therefore reflect documented business use and risk rather than technical prominence.

Metadata remains essential because it links the CDE to definitions, systems, lineage, owners, and quality controls.

Reference Topics: DAMA-DMBOK2 Chapter 13 — Critical Data Elements; Prioritization; Business Impact; Risk; Data Governance; Metadata.

===============