Data risk needs operating controls, not more policy

Policy tells us what should happen.  Controls make it happen, become measurable, and provable.  If unstructured data is the generally the main course for AI initiatives, we might be overdue for a controls library for data risk?   Over the past year, we built one: twenty controls, three pillars, and this is key…named ownership.

A speed limit sign is policy.  The county deputy parked behind a grain elevator is a control.  Only one of them has ever slowed anybody down or enforced anything.

Data risk has a lot of “signs” as well.  Most enterprises have a classification policy, an acceptable use policy, a retention policy, and an AI policy.  They're all reasonable.  They're all “agreed to” and signed.  But rarely, on their own, do they stop a sensitive file from being accessed, or from leaving the organization.

When something goes wrong, it seems our instinct is to write more policy.  Another standard in the mix.  Another committee.  Another PDF in SharePoint that is opened a couple of times a year.

Data risk doesn't need more signs.  It needs deputies.  It needs operating controls.

What the “Top 20” frameworks got right

In 2008, a grassroots consortium of practitioners published the SANS Critical Security Controls, better known as the SANS Top 20.  The Center for Internet Security took them over in 2015, and they've been the CIS Controls ever since.

The Top 20 didn't ask whether you had an asset management policy.  It asked whether you knew what was plugged into your network.  Every control was prioritized, prescriptive, and measurable, and the list was built from what defenders watched attackers actually do.  Do these core things fairly well and the likelihood of being a victim of an indiscriminate attack is low.

The CIS Controls have kept moving in our direction, too.  Version 8, released in May 2021, cut the list from twenty to eighteen and shifted from device-centric to data-centric.  Version 8.1, released in June 2024, added Governance as a proper security function.

So the old guard already sees where this is headed.  What data in the AI era still doesn't have is a controls library of its own: one built for a world where a single sensitive file is a DLP question, a DAG question, a DLM question, a lineage question, a quality question.

Twenty controls, three pillars, an owner on every one

The Data Risk Operating Controls are a critical controls library for Adaptive Data Risk Management, and they didn't start from a blank page.  They're built on DataRAMP™, the data risk framework Infolock developed over two decades of running data protection programs for regulated enterprises.  Twenty controls, organized under three pillars that mirror how data risk programs actually grow up.  And while the order is nice to get right, few did and that’s ok.  The good news is we can enter from any level and adjust to accommodate.

• Governance: the accountability, classification, and policy fabric.  Without it, every downstream control degrades into reactive enforcement.

• Visibility: continuous insight into where sensitive data lives, who can reach it, and how it moves.  It's the prerequisite to every protection decision, and it's gotten very good.  It's also just one stage of a cycle the industry keeps leaving unfinished.

• Protection: the controls that prevent loss, contain exposure, and resolve incidents as they happen.

Two design choices set it apart.

Every control is named for an outcome, not an activity.  "Conduct quarterly access reviews" is an activity.  "Stale and excessive access is automatically revoked" is an outcome.

Every control carries an explicit owner across IT, Security, and the Business Unit.  That's the central design principle.  Data risk is structurally cross-functional, and pretending otherwise is a big part of why traditional data governance failed.  Silos are great for holding grain, but they are inherently bad for enterprise collaboration.  We have to change this culturally and the process is already started.

Governance: whose name is on the gate

Every gate on a farm has somebody's name on it.  When the goats get out, nobody holds a meeting to figure out whose problem it is.  Governance is the five controls that put a name on every gate.

Watch G4.  Exceptions without an expiration date don't stay exceptions.  They become permanent gaps, filed in an incident bit bucket.  A time box turns every override into a decision somebody has to make again.  Two levels of morale impact there.  We can do better.

Visibility: walk the fence line

A fence is only as good as the last time somebody walked it.  Visibility is the five controls that keep walking it, every day, across every repository you own.

Watch V5.  Unsanctioned AI tools are the new USB stick.  The most modern exfiltration path in the enterprise is an employee pasting a customer list into a chatbot to save twenty minutes.  Usually without a shred of bad intent, which is exactly why that needs a control instead of a reminder or lecture.

Protection: keep the goats in the barn

Most programs are very good at closing the barn door after the goat is three counties over.  Protection is the ten controls that keep it inside.

Watch P10.  This is the control most programs don't have at all.  An alert that never becomes a case never gets decided, it just ages.  P10 makes every detected risk a structured case with an owner, a clock, and a resolution. This isn't data risk per se, but rather risk of data risk operation efficacy.

Where policy finally shows up for work

A policy says what should happen.  A control proves it did, every day, with a number attached.  That's the difference between a program that passes an audit and one that actually lowers risk.

Now look at those owner columns again.  Almost every control needs IT, Security, and the business to act together, often within minutes.  That's the hard part, and it's where most programs stall: the alert lands with Security, the system belongs to IT, and the decision belongs to a business owner who never saw the alert.

That's the gap NOOTRON was built for.  NOOTRON doesn't replace the tools that run these controls.  It's the decisioning layer that operates across them.  It normalizes the signals, routes each decision to the owner the control names, acts within the authority that owner has granted, and keeps the receipts.  Controls that used to be quarterly projects become continuous operations.

Policy isn't going anywhere.  It just finally gets a deputy.