Here is a quick overview of the key definitions of Protecto.
General
|
Data Assets
|
Data tables or data objects.
|
|
Security Risk or Breach Risk
|
Estimated security risk based on the type of Personal Information (PI/PII/Sensitive), size of the table, and extent of access privileges.
|
|
Risk Level – Breach Risk
|
Based on the calculated breach risk, we categorize the severity of breach risk into 4 types:
|
|
Excessive Access Privileges
|
Good: Many users have access to the data asset, and more than 20% are active users.
Broad: Many users have access to the data asset, but only 5% to 20% of users are actively using the data.
Excess: Many users have access to the data asset, but less than 5% are active users.
|
|
Stale Data by Risk
|
Estimated risk based on the number of unused data assets in the past 90 days.
|
|
Privacy Risk Data
|
Estimated privacy risk of a data asset based on the type of personal data (PI/PII/Sensitive), size of the table, and activities.
|
|
Privacy Risk (Data Usage)
|
Estimated privacy risk of a data asset based on the type of personal data (PI/PII/Sensitive), size of the table, and activities in the past 90 days.
|
|
Risk level – Privacy Risk
|
V High: High risk of data privacy violations. The data likely contains PII and may not have the necessary controls or accountability.
High: Above average risk of data privacy violations. The data may contain PII and may not have the necessary controls or accountability.
Medium: Moderate risk of data privacy violations. The data may contain some personal data, likely non-identifiable.
Low: Low risk of data privacy violations.
|
|
Active Stale Infrequent
|
Active: Data assets that were accessed multiple times in the last 90 days.
Stale: Data assets that were never accessed in the last 90 days.
Infrequent: Data assets that were accessed once the last 90 days.
|
|
Activities Count
|
The number of times the data asset was accessed.
|
|
Data Catalog
|
The data governance team can view the list of data assets, where they can add consent, data subject type, data subject location, and tags for the data assets.
|
|
Purposes
|
The data governance team can add new purpose, data subject type, and consent so that it will get reflected in the Data Catalog page.
|
User Types
|
Data Governance / Compliance Manager
|
The governance team identifies risks and tracks governance metadata needed for compliance from data teams. Security team can login as governance manager to view high risk data, overexposed data and inactive access privileges.
|
|
Data – Business Owner
|
They provide the governance team with privacy and compliance metadata such as data subject type, location, retention, consent, etc.
|
|
Data Users, Applications
|
Users or applications that access and use the data.
|
Data Types
|
Data Types
|
PI: Personal Information. You cannot identify the individual only with PI data (e.g., person country, DOB)
PII: Personally Identifiable Information. You can identify the individual with PII data (e.g., name, email)
Sensitive: e.g., race, genetics, religious preferences
|
