Trick or retain? What we have, where it is, and why we keep it

At the start of Cybersecurity Awareness Month, we suggested that before asking, "Is our information secure?" Organizations should ask three simpler questions: Do we know what we have, where it is, and why we are keeping it? 

They sound simple. Answering them is harder. On Halloween, it seems fitting to check what's lurking in the dark corners of your information environment: the forgotten shared drives, abandoned systems, and stray copies that no one remembers creating. As the month closes, here is how the pieces of this series fit together, and how to tell whether your organization can answer those questions today.

What we have

Answering "what" depends on more than a list of systems. Security teams may know which servers or accounts were compromised, but knowing the systems does not tell you what information was on them. Technical visibility isn't the same as information visibility.

Records inventories and data classification help close that gap. Inventories identify the types of information an organization holds and who owns it. Classification shows which of that information carries the most risk. Together, they mean that when something goes wrong, you are not starting from scratch.

Where it is

Information rarely stays where it started. A record created in a business application can end up in a spreadsheet, an email attachment, a laptop, and a shared drive before anyone notices. Each new copy is another location to protect, and copies often lack the controls that protect the original. Some become digital ghosts, lingering long after anyone remembers why they were created.

Data maps follow information as it moves, including when it leaves the organization for third parties. Identifying systems of record tells you which copy is the authoritative one, which matters a great deal when a system is encrypted by ransomware and recovery must be prioritized. If your map stops at your own network, your answer to "where" is not yet complete.

Why we keep it

The third question is the one most organizations skip. Much retained information is kept not because anyone decided to keep it, but because no one decided to delete it. That is how data hoarding becomes the treat that keeps on giving (to hackers). Information that should have been laid to rest years ago has a way of coming back to haunt you in a breach.

Retention schedules turn that default into a deliberate decision. Routine, defensible disposal is what makes those decisions matter. A schedule that sits on a shelf protects no one. It works as a security control only when its rules show up in systems, processes, and everyday behavior. 

Three treats, no tricks: A quick self-assessment

Get legal, records, privacy, IT, security, and business leaders in one room. Cyber preparedness cannot rest with IT alone; it is a shared responsibility. Security teams should not have to determine retention requirements, and records professionals should not be expected to design technical security controls. Legal, records, privacy, IT, security, and business teams each contribute different expertise.  

Consider three practical treats for your organization's information governance:

• Treat 1 – Take inventory: If our most sensitive repository were compromised today, could we say within hours what types of information it held and who owns that information? Start by identifying one high-risk repository and confirming its contents and owner.
• Treat 2 – Follow the data: Do we know where copies of that information have spread, including to vendors and cloud platforms? Trace one critical information type across systems and third parties.
• Treat 3 – Clear out the cobwebs: When did we last dispose of information under our retention schedule, and can we document it? Identify one category of information eligible for defensible disposal and take action.

If any answer is "we would have to find out," you have found your starting point. Pick one repository, one owner, and one next step. The goal is not perfection; it is a sustainable process. Then test your answers in your next incident-response tabletop exercise, before an attacker tests them for you. Better a planned scare than a real one.

The questions outlast the month

None of this replaces firewalls, encryption, multifactor authentication, or forensic investigation. Information governance helps you understand what those controls are protecting. Organizations that can answer "what," “where,” and “why” respond faster, have less information exposed, and recover more effectively.

Cybersecurity Awareness Month is over, but the questions remain. Keep asking them, because the information you do not know about, or do not need, is what comes back to haunt you.