NIST 800-53 REV 5 • PROGRAM MANAGEMENT
PM-23 — Data Governance Body
Establish a Data Governance Body consisting of {{ insert: param, pm-23_odp.01 }} with {{ insert: param, pm-23_odp.02 }}.
Supplemental Guidance
A Data Governance Body can help ensure that the organization has coherent policies and the ability to balance the utility of data with security and privacy requirements. The Data Governance Body establishes policies, procedures, and standards that facilitate data governance so that data, including personally identifiable information, is effectively managed and maintained in accordance with applicable laws, executive orders, directives, regulations, policies, standards, and guidance. Responsibilities can include developing and implementing guidelines that support data modeling, quality, integrity, and the de-identification needs of personally identifiable information across the information life cycle as well as reviewing and approving applications to release data outside of the organization, archiving the applications and the released data, and performing post-release monitoring to ensure that the assumptions made as part of the data release continue to be valid. Members include the chief information officer, senior agency information security officer, and senior agency official for privacy. Federal agencies are required to establish a Data Governance Body with specific roles and responsibilities in accordance with the [EVIDACT](#511da9ca-604d-43f7-be41-b862085420a9) and policies set forth under [OMB M-19-23](#d886c141-c832-4ad7-ac6d-4b94f4b550d3).
Practitioner Notes
A data governance body is a group within your organization responsible for making decisions about how data is managed, shared, protected, and disposed of. It ensures data practices are consistent and compliant across the organization.
Example 1: Form a data governance committee that includes your privacy officer, CISO, legal counsel, and representatives from major business units. Meet quarterly to review data policies, approve new data collection activities, and resolve data-sharing disputes.
Example 2: Charter the committee with a formal terms of reference document that defines their scope, decision authority, and escalation path. Use Microsoft Purview's Data Catalog to give the committee visibility into data assets, classifications, and lineage across the organization.