CSA ISO/IEC TR 38505-2:19 – Implications of Data Governance: A Technical Guide

Scope and Purpose of CSA ISO/IEC TR 38505-2:19

CSA ISO/IEC TR 38505-2:19 is the Canadian adoption of the International Technical Report ISO/IEC TR 38505-2:2018 – Information technology — Governance of IT — Governance of data — Part 2: Implications of ISO/IEC 38505-1 for data governance. As a Technical Report (TR), this document is strictly informative; it does not contain mandatory requirements but rather provides a detailed analysis of the practical implications of applying the governance principles outlined in ISO/IEC 38505-1.

The core purpose of this Technical Report is to operationalize the abstract governance model of its predecessor, particularly focusing on how the “Evaluate, Direct, and Monitor” (EDM) model interacts with distinct data attributes, varying lifecycle stages, and different organizational contexts. For data governance officers, enterprise architects, and IT steering committees, this document is critical for translating high-level governance directives into actionable, context-aware policies that respect the unique nature of data as an asset.

Tip: While ISO/IEC 38505-1 establishes the foundational principles and model for governing data, Part 2 provides the essential contextual nuance. It addresses how governance rules might shift depending on whether data is operational, analytical, sensitive, or archival.

Technical Requirements and Key Governance Implications

Although the document does not prescribe “shall” statements typically found in normative standards, it defines a rigorous set of implications that a governing body must systematically consider. These implications are mapped directly to the E-D-M model and explored across several dimensions of the data ecosystem.

Applying the E-D-M Model to Data Contexts

Evaluate: The governing body must continuously evaluate the current and future use of data, assessing its value, associated costs, and inherent risks (privacy, security, regulatory). The TR emphasizes evaluating the context of data to inform decision-making.
Direct: The governing body directs the preparation and implementation of policies. The TR highlights directing specific management activities aligned with data classification, lifecycle controls, and the assignment of decision rights across data owners and stewards.
Monitor: Conformance to policy is monitored through data-specific attributes. The TR encourages monitoring data quality metrics, access logs, and regulatory compliance to close the feedback loop for the governance body.

Table 1: Core Data Attributes and Governance Implications Derived from CSA ISO/IEC TR 38505-2:19
Data Attribute	Governance Implication	Example Policy Directive
Data Sensitivity	Higher sensitivity demands stricter access control, encryption, and audit trails.	Classify all PII and enforce strict role-based access with encryption at rest and in transit.
Data Volume	Large volumes or high velocity necessitate automated discovery and policy enforcement.	Implement automated Data Loss Prevention (DLP) and retention rules for big data platforms.
Data Lifecycle Stage	Active, warm, and cold/archival data require distinct governance rules and cost structures.	Define different tiered storage policies, replication factors, and backup SLAs for production vs. archival data.
Data Provenance	Internal vs. external (third-party) data impacts accountability, trust, and legal liability.	Establish contractual data quality SLAs for providers and audit data lineage for critical reporting data.

Implementation Highlights

Implementing the guidance of this Technical Report requires a shift from a blanket data governance approach to a context-driven governance model that adapts dynamically to the nature of the data.

Defining Decision Rights

A significant implementation highlight is the emphasis on “who decides what.” The TR guides organizations in assigning specific decision rights: Data Owners (accountable for assets), Data Stewards (responsible for quality and lifecycle), and Data Custodians (responsible for technical environments). This separation of duties is directly aligned with the Direct component of the EDM model.

The Data Consumer-Provider Paradigm

The TR explores the implications of viewing data through a market lens. Data producers (source systems) and data consumers (analytics, applications) must interact through a governed interface. The governance body must ensure that policies covering the exchange—such as service-level agreements for data quality, latency, and security—are explicitly directed and monitored.

Implementation Insight: Organizations achieve the greatest success when they implement this governance framework using a federated model. This acknowledges that a single monolithic policy cannot effectively govern all data contexts, allowing business units to tailor implementations while adhering to a centrally defined governance strategy.

Integration with Corporate Governance (ISO/IEC 38500)

This Technical Report is part of a vertically integrated framework. Data governance (TR 38505-2) is a domain of IT governance (ISO/IEC 38505-1), which is itself a component of corporate governance (ISO/IEC 38500). Implementation must ensure that data-related directives are aligned with and cascaded from overarching business strategy and stakeholder expectations.

Compliance Notes and Best Practices

Since this document is a Technical Report (informative, not normative), there is no formal certification against CSA ISO/IEC TR 38505-2:19. However, it serves as a powerful tool for audit readiness and due diligence.

Evidence of the E-D-M Cycle: Auditors evaluating broader compliance frameworks (such as COBIT, Sarbanes-Oxley, or PIPEDA) look for evidence of a systematic EDM cycle. This TR provides a checklist of implications to help prove the governing body has evaluated risks, directed controls, and monitored outcomes effectively.
Privacy Compliance Readiness: The implications regarding data sensitivity and lifecycle directly support compliance with international privacy regulations such as GDPR and Canada’s PIPEDA. It provides a structured, top-down approach to demonstrating accountability for personal information.
Risk-Based Prioritization: By focusing on the evaluation of data contexts and attributes, organizations can prioritize governance investments. Not all data is equal; sensitive customer data demands robust oversight, while anonymous operational logs may require less intensive governance. This risk-based approach is a best practice promoted by the TR.

Caution: Avoid governance sprawl. The depth of implication analysis in the TR can tempt an organization to create overly complex governance boards and policies. The best practice is to apply a “minimum viable governance” principle—start with high-impact data attributes and governance processes, then expand iteratively based on evaluated risk.

Frequently Asked Questions

Q: What is the exact difference between CSA ISO/IEC TR 38505-2:19 and ISO/IEC 38505-1?
A: ISO/IEC 38505-1 is the foundational standard defining the principles and the EDM model for the governance of data. CSA ISO/IEC TR 38505-2:19 is a separate companion document that provides a detailed analysis of the implications of applying that model to specific data characteristics like sensitivity, volume, and lifecycle. Part 1 establishes the governance framework; Part 2 guides its contextual application.

Q: Can an organization be certified against this standard?
A: No. As a Technical Report (TR), it is purely informative and contains no mandatory requirements. It cannot be audited or certified against. However, it is an excellent tool for preparing for audits against related normative standards (e.g., ISO/IEC 27001 for information security or ISO/IEC 38500 for IT governance) and for demonstrating due diligence in data privacy regulations.

Q: What types of data are covered by the governance framework in this TR?
A: The framework is entirely technology and data-type agnostic. It covers structured data, unstructured documents, transactional records, analytical data warehouses, master data, and metadata. The critical factor is not the technical format, but the context and attributes of the data in question.

Q: How does this Technical Report interact with privacy laws like Canada’s PIPEDA?
A: It provides a high-level governance framework for implementing the accountability principle found in modern privacy laws. By applying the direction given in the TR for evaluating data sensitivity and monitoring access, an organization can demonstrate robust governance practices that directly support compliance with legal requirements for handling personal information.

This article provides a general technical overview of CSA ISO/IEC TR 38505-2:19 for professional development purposes. Organizations should acquire and study the full text of the official publication for exact terminology and detailed guidance.

📥 Standard Documents Download

🔒

Please wait 10 seconds, the download links will appear after the ad loads