Gartner发布中国数据安全安全与风险管理领导者指南：将孤立的数据安全产品集成到数据安全平台中，实施一致的数据安全策略资源-CSDN文库

需积分: 5 195 浏览量 2024-05-23 18:09:16 上传评论收藏 1.51MB PDF 举报

资源推荐

资源详情

资源评论

Gartner, Inc. | G00775485

Page 1 of 17

Security and Risk Management Leaders’ Guide to

Data Security in China

Published 27 March 2024 - ID G00775485 - 21 min read

By Analyst(s): Anson Chen, Jie Zhang

Initiatives: Digital Technology Leadership for CIOs in China; Security of Applications and

Data

Organizations doing business in or related to China face increasing

data security risks and regulations. Security and risk management

leaders must adopt risk-prioritized data security programs and

investment in response to regulatory requirements to empower

data-enabled digital innovation.

Overview

Key Findings

Recommendations

Security and risk management leaders in China responsible for data security must:

Dispersed data security initiatives and uncoordinated stakeholders’ responsibilities

spanning across organizational functions has impeded the organization to realize

an enterprise-scale consistent data security governance (DSG).

■

Data discovery and categorization is fundamental to DSG and has been

implemented through manual processes in most organizations. However, this is

neither scalable nor effective.

■

Point-in-time data risk assessments (DRAs) are generally not sufﬁcient to fulﬁll

diverse and evolving compliance requirements on risk identiﬁcation and handling as

organizations’ data processing activities develop dynamically.

■

Increasing data movement across applications and data storages on-premises and

in the cloud results in security and risk management (SRM) leaders struggling to

enable uniﬁed data visibility and security controls.

■

This research note is restricted to the personal use of liuyang17@qianxin.com.

Gartner, Inc. | G00775485

Page 3 of 17

Introduction

Organizations doing business in China now face unprecedented data security risks

resulting from malicious activities and compliance obligations (such as the China Data

Security Law (DSL) and China Personal Information Protection Law (PIPL)) than ever

before. While the local regulators continue to issue new guardrails for cyber and data

security, there has been a powerful digital business innovation atmosphere in China (see

Leadership Vision for 2023: CIOs and Their Teams in China). Competitions in exploring

data for new digital products and services continue to drive investment and new business

behaviors in China.

At the same time, concerns of mishandling and misuse of data are rising. The heavily

regulated sectors (e.g., government, ﬁnance, healthcare and telecommunication) have

been obliged to comply with the industry-speciﬁc standards and guidance from the

industry regulators for several years. They still need to keep up with the evolving

regulatory requirements on data security and usage. Many organizations outside these

sectors ﬁnd themselves in a similar position.

1

They are just starting their journey and

need to catch up quickly. While there are data security frameworks, standards and

technologies available in the market, ﬁnding the right combination of frameworks,

processes, technologies and skillful talents to achieve compliance and better data security

remains a challenge for many SRM leaders.

Organizations need to rapidly formalize data security programs that align to business

innovation appetites as well as established frameworks. What are the required steps to

plan and set up data security programs? This research note introduces a structured,

iterative and risk-based approach (see Figure 1). SRM leaders can apply tips and

resources to formalize their DSG and management function; prioritize data security risks

and investments; and implement a coherent set of security controls.

This research note is restricted to the personal use of liuyang17@qianxin.com.

剩余24页未读，继续阅读

内容反馈

lurenjia404

粉丝: 2507
资源: 138

最新资源

资源上传下载、课程学习等过程中有任何疑问或建议，欢迎提出宝贵意见哦~我们会及时处理！点击此处反馈

feedback-tip