I recently had the pleasure of joining Kim Hakim on her podcast, And Security For All, for a second time. Our conversation focused on Strengthening Security Through Data Classification and Governance.

At the university, our journey in still in its infancy, but rapidly moving along. A data breach scare served as a wake-up call, pushing us to reassess and update our data classification policy. In addition to this policy, we procured Concentric AI to help classify unstructured data in alignment with our updated guidelines. I found that Microsoft Purview was too burdensome and clunky to classify things like student grades. Concentric AI was able to accurately do this without any intervention from or the team. This step has been pivotal in understanding and protecting the vast amounts of sensitive data in our environment.

Currently, we’re tackling the next phase which is updating and enforcing our data retention policy. This is in preparation of our rollout of generative AI tools like Co-Pilot and ChatGPT. These tools will help us gain efficiencies, but require a secure environment to ensure compliance and protect institutional data.

It’s a long and challenging journey. No one likes their data messed with or moved. A lot of communication has to go out, informing users around data labels and classifications. As we continue to navigate through our own project, if anyone has walked this road before, feel free to leave any tips in the comments below.