Information Governance Framework & Policies Flashcards

When an organization undergoes a merger, which IG activity is MOST urgent to perform regarding information assets?

Answer: Conducting an information inventory and gap analysis of both organizations' IG frameworks

A merger requires an information inventory and gap analysis to identify IG framework differences, redundancies, and risks before integration decisions are made.

Which of the following BEST describes 'information governance' as distinct from 'records management'?

Answer: Information governance is a broader strategic framework that encompasses records management along with data governance, privacy, security, and compliance

IG is a holistic, strategic discipline that encompasses records management and extends to include data governance, privacy, security, compliance, and risk management across all information assets.

A Chief Information Governance Officer (CIGO) is MOST responsible for:

Answer: Overseeing the enterprise IG program, ensuring alignment with strategy, and driving policy adoption across business units

The CIGO provides strategic leadership for the enterprise IG program, aligning IG initiatives with organizational objectives and driving cross-functional adoption.

Which of the following would be considered a 'defensible disposition' practice in IG?

Answer: Destroying records according to documented retention schedules after confirming no legal holds apply

Defensible disposition requires systematic destruction based on approved retention schedules, with legal hold checks and documented authorization to withstand legal scrutiny.

Under GDPR, which IG principle requires that personal data be kept only as long as necessary for its stated purpose?

Answer: Storage limitation

GDPR's storage limitation principle requires that personal data not be kept longer than necessary for the purposes for which it was collected.

An IG policy that applies to all employees, contractors, and vendors who access organizational information reflects which best practice?

Answer: Defining a broad scope that covers all parties who interact with organizational information regardless of employment status

Effective IG policies must extend to all parties accessing organizational information — including contractors and vendors — since data risks are not limited to internal employees.

Which approach BEST supports continuous improvement of an IG framework over time?

Answer: Establishing ongoing monitoring, periodic audits, and a feedback loop that drives policy revisions

Continuous improvement requires regular audits, monitoring of compliance metrics, and a formal feedback process to update policies as regulations, technology, and business needs evolve.