WIXLIB

Data Governance at the Church ofJesus Christ of Latter‐day Saints:Governance, Quality, and SecurityBy Pablo J. RiboldiInformation Governance, Quality, & Security2007 ‐ 2013

Program Evolution (years 1‐3)Dec 2006May 2007June 2007July 2007Aug 2007Dec 20072007‐2010Jan 2008Apr 2008Feb 2009Jul 2009 IRI 2013Data Stewardship policy is formally approved starting theIGM program for the whole enterprise.Hired Information Governance Manager (Pablo Riboldi).MDM started sharing enterprise reference data sets(Currencies, Geopolitical Locations, Languages).Information Classification & Handling policy is approved.Created template for Data Sharing Agreements (DSA).MDM added 2 main data sets (Organizations, Assignments).Three 1‐year interns worked to supplement IGM team.Created DSA Library as a SharePoint site.Created Data Sharing Agreement Process and DataSteward Designation process.Joined Data Sharing Agreements into one format.Created Common Data Matrix spreadsheet as a precursor tothe Data Sharing Portal (DSP).2

Program Evolution (years 4‐5)Feb 2010Jun 2010Sep 2010Nov 2010Jan 2011Feb 2011Mar 2011May 2011Aug 2011Sep 2011Oct 2011 IRI 2013Launched Data Sharing Portal v1.0. Started documentingdata domains and designated data stewards.MDM added 2 more data sets (Leadership, Finance Config).Created quality matching for Temple Entry System migration.Started working relationship with new Data Privacy Officer.Joined Information Quality team to InformationGovernance, creating IGQ team (1 manager, 3 engineers).Launched Address Standardization service (1 customer).Launched DSP v2.0. Started documenting data elements.Launched IDVault Synchronization Quality Dashboard.Created Information Governance Issue Resolution process.Hosted 1st Data Stewards Conference.MDM added facility information (10 data domains served).3

Program Evolution (years 6‐7 . . .)Jan 2012Apr 2012May 2012Jul 2012Aug 2012Sept 2012Dec 2012Jan 2013Jan 2013Feb 2013 IRI 2013Added Information Security to IGQ team responsibilities,increasing the team to 6 (1 manager, 5 engineers).Database Security Policy is approved.Launched Database Security Dashboard to production.MDM added 2 data sets (IT Infrastructure, HumanResources).Launched MDM Data Model in Data Modeling Portal.Upgraded Address Standardization service (5 customers).Launched DSP v3.0. Started online DSA processing.Facilities Department contracts IGQS engineer forlong‐term quality improvement intervention.IGQS team remains intact after a department‐wide 7%reduction‐in‐force.Online Store becomes user of Address Standardization.4

Scale of the Solution—Structure3) For full disclosure, due toorganizational changes, this committeeso we are committeelooking for a2) wasThis dissolved,high level executivenew,high‐levelsponsor.However,sponsored the Information GovernanceInformationGovernanceis so muchprogramand assertedownershipof all partof thedataenterpriseChurchassets. culture, that theprogram has continued moving forward.1) Even though the InformationGovernance Program was started and issponsored by the Information &Communication Services Department (ITside), it provides data governance as aservice to the whole Church.MICC Executive Committee (CIO)(Executive Decisions, Program Sponsorship, Data Owners)10) Internal and external entitiesrequesting access to Churchenterprise data work with IGQS toobtain authorized access to theinformation. These requestors expandthe scale of Governance worldwide.9) IGQS develops processes, tools,reports to support the Data Stewardsgoverning the information under theirstewardship.8) IGQS and the data stewards designspecific interventions to improvegovernance for their data domains. IRI 2013Managing Directors (22 Departments)(Designate Data Stewards)Data Privacy Office (2)(Ensure compliance with privacy laws worldwide)Data Stewards (60)(Tactical Decisions, Classification)Data Coordinators (29)(Operational Decision, DataDefinitions)7) New data stewards receive trainingfrom IGQS and plan with IGQS whatgovernance initiatives they want to focuson: sharing, security, quality,classification, etc.54) By policy, the MICC delegatesstewardshipof specificdatadomainsto5)The Data PrivacyOffice(DPO,part ofthe Correlationdepartments,and the ManagingtheDepartment)functions asDirectorsdesignateDataStewardsto ofa special Data Steward reviewing usedischargeidentifiabletheir responsibilities.personalinformationworldwide. They engage external legal6) Some Data Stewards designate one orcounsel when necessary.more Data Coordinators to assist them.All the Data Stewards and Coordinatorsreport to the management structurewithin the departments they represent.

Communities served by DG ProgramInformation Governance directly involves and affects: 60 Data Stewards from 22 departments governing data 85 Product Managers from 26 departments requesting data 65 internal organizations requesting enterprise data through DSAs 37 external organizations requesting enterprise data through DSAs 100 developers coordinating data services and connections 86 Solution Managers ensuring proper use of enterprise data 33 database engineers implementing DSAs and database security 24 IT Portfolios receiving DB Security reports for 589 audited databases 8 enterprise applications standardizing millions of addresses worldwide 6 enterprise applications doing continuous data quality interventions IRI 20136

Problems / Solutions / Impact / Benefits IRI 20137

1) In the beginning . . . no Governance Early 2006, the Church Education System (CES)requested the Data Warehouse (DW) team to createreport showing financial information for Seminariesand Institutes worldwide.Finance & Records Department (FRD) asserted thatthe financial data was theirs and ordered the DWteam to shut the CES reports down.The DW team removed the reports.CES complained and asserted that financial dataabout CES was rightfully theirs. They ordered the DWteam to open the reports again.CES and FRD were log‐jammed for months. DW teamwas in the middle. Who owns the data? Who decides? IRI 20138One of CES Institute buildings at a university campus.This was one of many intractableproblems related to lack of governance.People and departments worked andsuffered in isolation using the “law ofgravity” and “data myning” as a way toendure through these problems.

1) In the beginning . . . no GovernanceApproved Data Stewardship Policy (Dec 2006) MICC owns all data stewardship decision. Stewards are accountable to the MICC for theirdata stewardship responsibilities. CIO represents the MICC and is authorized to make routine decisions on their behalf. As Data Domains are assigned to departments, Managing Directors will make specificstewardship assignments which will be documented and distributed among key stakeholders. For particular issues, as needed, key data stewards are organized in working groups led bythe CIO who submits proposals to the MICC. Through the years this policy has beeninvaluable to IGQS, giving us theauthority to affect the whole enterprise.Started Information Governance at the Church.Creation of the Information Governance Management team to support implementation ofthe policy.Even though the title designation “DataClear “ownership” of data assets, and delegation of “stewardship”.Clear line of authority to resolve information governance issues.Clear responsibilities to data stewards. IRI 20139Steward” is an industry standard, it hasdistinct,important,clear implicationsData SChurchThe1) Obtain adequate notice andculture.appropriateconceptsforof personal“steward”information.and riptures2) Ensure proper access andof data.and Churchemployeesreadilyaccuracy.3) Ensurequality,completeness,understandfull meaningof these4) Ensuredata theis properlyclassifiedfor use,concepts.processing and storage.5) Ensure handling requirements andrecords retention plan exists.

2) DG Vision, Strategy, Direction After the Data Stewardship Policy was approved and IGM wasestablished, we still needed to decide . . . What do we do now? IGQS General Principles Long‐term Directives Avoid data duplication that causes datareconciliation and differences inmanagement reportingAvoid development of duplicatefunctionality in information systemsEnd‐user experience should not becompromised by systems’ efficiencySpecific enterprise information is clearlyowned and resides in one system ofrecordSystems of record provide visibility of theirdata to other systems as needed andauthorized Data Stewards for all enterprise information are clearly designatedand publishedData Stewards clearly understand and are held accountable forthe discharge of their responsibilitiesData Stewards can easily understand and monitor the security,quality, usage, and definitions for the data under theirstewardshipEnterprise data is shared among authorized systems usingappropriate methods that eliminate data duplication and avoidreconciliationsCustomers and team members understand the data governanceprocess and use it appropriatelyThe data governance process is effective and efficientData Governance assures compliance with Church IT policies andinitiates policies where necessary IRI 2013 10Bring Forth the Records Gary Kapp

2) DG Vision, Strategy, Direction After the Data Stewardship Policy was approved and IGM wasestablished, we still needed to decide . . . What do we do now? Long‐term Directives IGQS General Principles Mostly local to the IGQS Team, helping us guide our plans and strategies.We validate Data Stewards’ ideas, plans, strategies against these principles and directives. Clear vision to check operational and tactical decisions against the long‐term vision.Bring Forth the Records Gary KappWhere there is no vision, the people perish.(Prov 29:18) IRI 201311

3) Data here, data there, data everywhere Applications needed data from other systems.Data was informally shared among systems using whatevermethods were available: from database links to spreadsheets.7,800 database links among 400 databases.––––– Who was responsible for these links?What were these links used for?Were they granted too many privileges?Are they still being used?Can we get rid of them?With no one responsible to ask and noone accountable to answer these andmany other questions, we were frozeninto inactivity.There were outdated copies of data sets everywhere.Business units were spending lots of time manuallyreconciling reports and data sets however they could.Trust and confidence in data, reports, metrics was low.Even though data was going everywhere, the wholeorganization was suffering fromsevere information drought. IRI 2013“You need that data.”“Yeah, but I don’t know how to get it.”“Hey, I used to work for this otherprojectthatthathaddata.”access to that, here’s“You needtheaccountand passwordtotoconnect.”“Yeah,but I don’tknow howget it.”“OK,thanks!”“I have it, I’ll send you a copy on aspreadsheet.”“OK, thanks!”12#2 Understatement of the century.#1 Understatement of the century.

3.a) Designate Data Stewards to Domains We began assigning data stewards to systems.– But, most systems had data from multiple sources, stewardship was not clear.So we changed by identifying data domains and assigning stewards to those domains.–––We started documenting these domains and stewardships in a spreadsheet: the Common Data MatrixPublished the Data Steward Designation ProcessLaunched the Data Sharing Portal (DSP)Thanks Bob Seiner! IRI 201313

3.a) Designate Data Stewards to Domains 22 Managing Directors haveApproved 60 Data StewardsOver 214 data domains, toClassify and define 2,744 elementsAnd growing! IRI 2013The DSP allows us to –––––14Identify and manage data domainsClearly assign stewardship to dataDescribe and classify domains and data elementsDefine data elements in business termsSearch for terms across all domains