Perspectives

Data governance for Aerospace & Defense (A&D)

Navigating costly compliance while safeguarding your data

Regulatory requirements for the protection of data have previously been, and continue to be, a costly problem for organizations to solve. Export Controlled Data (International Traffic in Arms Regulation (ITAR) and/or Export Administration Regulations (EAR)) and Controlled Unclassified Information (CUI) have stringent requirements around the protection of specific controls ― which can be costly if not implemented holistically with a data governance program.

Take control of your data. Let’s take a look at the benefits of a broad-based data governance program…

Welcome to our 6-part series about implementing data governance for the Aerospace & Defense (A&D) sector. This series discusses key themes, leading practices, and thoughts on how data governance might benefit your organization and how Deloitte could help ease the burden:

  • Release 1: Data classification
  • Release 2: Data discovery
  • Release 3: Tagging and labeling
  • Release 4: Protect and monitor
  • Release 5: Cloud
  • Release 6: Product Lifecycle Management (PLM)

Data Governance (Classification, Scanning, Tagging & Labeling) is crucial to organizations within the Defense Industrial Base (DIB) at a holistic level. Implementing specific facets or features of a Data Governance Program does not provide the total value which a holistic program provides. When implemented correctly, Data Governance is beneficial for several reasons:

  • Security and compliance: Failure to protect data appropriately could lead to security breaches, regulatory violations, and potential legal consequences for regulations and security requirements, such as the National Institute of Standards and Technology (NIST) Special Publication 800-171 or 800-53
  • Access control: Establish granular access controls to allow access to sensitive data, CUI, or Export Controlled data to authorized personnel only; Use of non-US citizens and/or persons may be leveraged in alignment with regulations to reduce operational overhead; Reduce the risk of unauthorized access, data leaks, or espionage in a properly segmented and/or protected environment
  • Data Handling Procedures: Establish clear guidelines for how data should be handled, stored and transmitted in circumstances where multiple program-specific data types may be involved
  • Incident response: Identify data that may have been compromised, take appropriate measures to mitigate the damage, and report the incident to the relevant authorities
  • Data retention and disposal: Enhance compliance with retention policies and privacy regulations, such as the Federal Records Act, General Data Protection Regulation (GDPR), and program-specific requirements
  • Risk management: Enable effective management and assessment of risk by categorizing data based on its sensitivity and importance; Facilitate better allocation of resources to help safeguard high-value assets, implement appropriate access controls, and prioritize security measures where they matter most
  • Competitive advantage: Proper data classification and security practices can serve as a competitive advantage, demonstrating the commitment to protecting sensitive government information
  • Customer trust: Implementing robust data governance and security measures enhances customer trust and could lead to long-term associations and repeat business

How Deloitte can help

Defining, scanning, tagging and labeling Export Controlled and CUI data can be an extensive effort ― and not solely a technology problem. At Deloitte, we have witnessed the challenges organizations face in completing these tasks and have developed techniques to overcome these challenges. This series will cover six core components of an effective program to protect sensitive data (e.g., ITAR, EAR, CUI, etc.) over the data lifecycle.

Fullwidth SCC. Do not delete! This box/component contains JavaScript that is needed on this page. This message will not be visible when page is activated.

Did you find this useful?
Data governance for next-generation platforms

Companies must adapt their data governance program to the reality of data explosion and disruptive technologies

Using information governance to manage data privacy risk

Enabling growth and innovation