Follow the data
Documenting where sensitive data comes from, what it passes through, and where it rests determines both the scope of an obligation and the threats that actually apply.
Ideas and field notes
Blog
Practical writing about cybersecurity, compliance, and sustainable security operations.
What counts as sensitive data
Sensitive data is not one category with one owner. Each kind carries a different obligation from a different source, and an organization that has not separated them cannot protect any of them deliberately.