Best Practice 7.3 – Protect your IoT data in compliance with regulatory requirements
Data governance is the rules, processes, and behavior that affect the way in which data is used, particularly as it regards openness, participation, accountability, effectiveness, and coherence. Data governance practices for IoT is important as it enables protecting classified data and complying with regulatory obligations. It helps to determine what data needs protection, or which data needs access control.
See the following for more information:
Recommendation 7.3.1 – Define specific roles for personnel responsible for implementing IoT data governance
For example, there might be a need for new roles to monitor security, from both the functional and policy perspectives, to control data when it moves from IoT environments to the cloud.
Recommendation 7.3.2 – Define data governance policies to monitor compliance with approved standards
For example, you might define a policy that requires security credentials to never be hardcoded, even on edge devices. Thus, only services like Secrets Manager can retrieve secrets in an encrypted manner.
Recommendation 7.3.3 – Define clear responsibilities to drive the IoT data governance process
Multiple administrative roles can exist for a single system. For instance, you may define roles for users who can replace defective devices, and separate roles for users who can apply security patches and upgrade device firmware. Note that roles and responsibilities might change over the lifecycle of your IoT systems.
