Define the Information Architecture

Define the Information Architecture

The information systems function creates and regularly updates a business information model and defines the appropriate systems to optimize the use of this information. This encompasses the development of a corporate data dictionary with the organization’s data syntax rules, data classification scheme and security levels. This process improves the quality of management decision making by making sure that reliable and secure information is provided, and it enables rationalizing information systems resources to appropriately match business strategies. This IT process is also needed to increase accountability for the integrity and security of data and to enhance the effectiveness and control of sharing information across applications and entities.

Enterprise Information Architecture Model

Enterprise Information Architecture Model

Establish and maintain an enterprise information model to enable applications development and decision-supporting activities, consistent with business and IT plans. The model should facilitate the optimal creation, use and sharing of information by the business in a way that maintains integrity and is flexible, functional, cost-effective, timely, secure and resilient to failure.

Enterprise Data Dictionary and Data Syntax Rules

Enterprise Data Dictionary and Data Syntax Rules

Maintain an enterprise data dictionary that incorporates the organization’s data syntax rules. This dictionary should enable the sharing of data elements among applications and systems, promote a common understanding of data among IT and business users, and prevent incompatible data elements from being created.

There are no PSGs published for this topic; however, the topic is under review for future PSGs.

Data Classification Scheme

Data Classification Scheme

Establish a classification scheme that applies throughout the enterprise, based on the criticality and of enterprise data. This scheme should include details about data ownership; definition of appropriate security levels and protection controls; and a brief description of data retention and destruction requirements, criticality and sensitivity. It should be used as the basis for applying controls such as access controls, archiving or encryption.