The Role of An Information Asset Owner

The Role of an Information Asset Owner

An information asset is a body of data and information of value to the organisation. It is defined and managed as a single unit so it can be understood, shared, protected and used effectively.

Grouping information into function-specific information assets can help organisations make decisions, allocate resources, and provide assurance. Effective management of Information Assets means they can be more efficient and productive.

Because they are valuable, information assets need to be protected as well as managed. Typically organisations will employ a range of technical and organisational measure to achieve this.

One of the organisational measures you can put in place to manage information assets is allocate them to an Information Asset Owner. Information Asset Owners (IAOs) can be given a range of duties and responsibilities. However, in summary:

  • The primary function of an IAO is to help ensure information security
  • The secondary function of an IAO is to support the delivery of data and information management in terms of accuracy, quality and accessibility, throughout the information lifecycle.

 

protecting business critical data

 

Data and Information

 

Although the terms data and information are often used interchangeably (and quite often the term “information” is used to describe both) they are different. Typically data is raw facts and figures. Information is data that has been given context and meaning – it is the result of data processing.

  • Data is the input
  • information is the output

Data is often collated into data sets. Data sets are structured data that can be used to generate information for performance management, reporting and other purposes.

Like any organisation you will keep your data and information on systems. Systems are not information assets. Information assets consist only of data and information, and not the tools we use to manage, analyse or exploit them. However, some types of data and information require specific tools and systems to exploit them and part of an IAO’s role is to ensure organisations have the right tools and systems available to exploit information assets.

Other things that are not information assets:

  • things of the same type: excel spreadsheets together are not an information asset
  • the same medium: emails together are not an information asset
  • the same security classification: an official or official sensitive classification does not tell you what information asset something is part of
  • things that have the same lifecycle or retention periods
  • a single document or data set. Usually information assets contain a range of information in a range of media.

An information asset holds data and information that support a particular function or functions. There is not one right or wrong way to describe what this means. We encourage people to think about what would be considered reasonable to include in an information asset, informed by subject matter experts and guided by managers and function heads.

 

Technical and Organisational Measures

 

With appropriate training and support IAOs can help deliver the technical and organisational measures to keep information assets safe and useful. Examples include:

  • The management of risks to information assets and the data and information in them
  • Granting and removing access to the information assets they own
  • Ensuring that appropriate security arrangements are in place for their information assets
  • Managing the quality of the data and information in the information asset, ensuring that it remains accurate and up to date
  • Ensuring compliance with policies and procedures when it comes to the use of their information assets
  • Working with the Data Protection Officer on the management of any personal data in their information assets
  • Ensuring compliance with records review and retention periods
  • Supporting compliance with statutory duties under the Freedom of Information Act, if they apply
  • Working collaboratively to address data quality issues

Working Collaboratively

Some of the key roles IAOs work with – some more directly or frequently than others – include:

 

Who Should Be an Information Asset Owner?

 

IAOs should be senior managers, such as heads of department, so that they can both direct and control their information assets and be accountable for their management. An IAO can own several information assets (but no information asset can have more than one owner). Sometimes an information asset can be large and complex.

When this happens IAOs should rely on other data roles, such as data stewards and data custodians, for the day to day management of their information assets.