Data Strategy Before Compliance: Why Companies Don't Know Where Their Data Lives
Where Is Your Critical Data?
An IT manager asked a question last week that he couldn't answer himself: "Do we actually know where our data lives?" He meant it rhetorically. The honest answer was: No.
Three cloud providers. Two AI tools in production. An incident response plan that simply names "IT" as the responsible party. No data map. No registry. No clear ownership. This is not an isolated case – it is the standard picture in mid-sized companies today.
The Silent Control Vacuum
Those who don't control their data don't control anything in the digital world. That sounds dramatic. But it is sober reality.
Every strategic decision – procurement optimization, customer analytics, forecasting models – is built on data. If no one knows which data is processed where, who has access, and how current it is, those decisions are built on sand. Not out of negligence. Out of structural loss of control.
What NIS-2 Actually Requires
These three requirements are mandatory under NIS-2, Article 21: First, companies must know where their critical data lives – documented and demonstrable. Second, it must be clear who has access to that data, with role-based assignment, not a blanket "IT." Third, access controls must be reviewed regularly.
Those who cannot demonstrate these three points have not just a security problem. They have a compliance problem with regulators – and a liability problem in the event of an incident.
The Structured Workshop Day
Setting up a data registry doesn't take weeks. It takes one structured workshop day – with the right methodology.
What this workshop produces: A prioritized overview of all critical data classes. For each class: storage location, processing context, authorized users, and last review date. Responsibilities are clearly assigned.
The Bottom Line
When did you last check whether you know where your critical data lives? If the answer takes longer than three seconds or starts with "probably" – today is the right day to change that.