7. Monitoring and Response | Sensitive Data Cleanup and Monitoring

7.1 Activity Summary

Activity Description	Once you have built a catalog of your unstructured data with ActiveNav Cloud, and addressed the findings of the initial discovery, you will enter a monitoring phase. At this point you can use regular re-discovery of Data Sources to ensure that you do not allow re-growth of sensitive data risk within your unstructured data.
Goals	Establish a periodic refresh for all Data Sources. Maintain alignment with organizational policy. Move to business as usual for sensitive data minimization.
Participants	Project Manager, Application Administrator, Data Analysts, IT team
Pre-requisites	Initial discovery and review has been performed on the Data Sources to be monitored.
Outputs	Up to date visibility of Sensitive Data prevalence.

As you complete the initial discovery for each Data Source there will normally be a wide range of findings that need to be reviewed and remediated. For a large range of repositories this initial activity could represent a significant investment of time from Data Analysts, and therefore it is critical to protect that investment. This can be achieved by scheduling regular rediscovery so that changes in the risk profile are captured.

7.2 Identify Data Sources for Re-Discovery

The first task is to determine which Data Sources should be re-discovered to maintain an up-to-date status. Some Data Sources may have been built from static archive data that does not need to be refreshed.

For the Data Sources that require refreshing, you must decide how frequently they should be re-discovered. This will be a subjective assessment based on how frequently the data source is used. For example, OneDrive data sources are used continuously and thus might be ones to schedule to run at shorter intervals. In addition, the nature of the data itself may warrant frequent re-discoveries to reduce the risk profile of the data as it relates to the organization.

7.3 Establish Rediscovery Schedule

Once you have determined which Data Sources require re-discovery, and the appropriate frequency, you can begin to schedule these activities.

This can be carried out via the Data Source overview page, as outlined in the KBA linked below:

Data Source Overview

You can schedule re-discoveries to occur on a one-time basis, as well as at intervals such as every week, month, 3 months, 6 months, or a year. The re-discovery process will use the metadata recorded during previous discovery activities so that Feature Extraction will be applied only to new and changed objects. This will usually mean that the time required for re-discovery is significantly less than the initial Discovery duration.

7.4 Review Results

When the re-discovery has been performed, the status of the Data Source can be reviewed. Normally this would be done by assessing changes in the Sensitive Data findings for any Business Units associated with the Data Source. If necessary, the Scoped Review process may lead to further remediation of new Sensitive Data findings.

The process for Scoped Review is outlined in the KBA linked below:

Introduction to Scoped Review

7.5 Review Configuration

If you are utilizing custom Feature Extraction rules, you should periodically review them to ensure that they still cover your Sensitive Data requirements. If the scoring hierarchy is updated, a recalculation on data sources will need to be done to take into account any new changes in the feature extraction rules.

Note that any time that you update your rule configuration, subsequent rediscovery tasks will take longer as the new rules must be applied to all objects.