Helpful first: Assets and the CIA triad: what we protect and how it fails · Privacy vs security: why an encrypted database can still violate privacy
Key points
- Distinguish Data Owner, System Owner, Data Custodian, Data Controller, and Data Processor responsibilities
- Compare military/government sensitivity labels with commercial classification tiers
- Map security controls across the six phases of the data lifecycle (Create, Store, Use, Share, Archive, Destroy)
Who owns the decision versus who runs the controls
In both enterprise security and certification scenarios, role confusion causes governance failures. The Data Owner (also called Information Owner) is a senior business manager or executive who understands the mission value and legal sensitivity of a dataset. The Data Owner determines the classification label, defines who may access the data, approves exceptions, and bears ultimate organizational accountability.
The Data Custodian is the technical practitioner (such as Kael Cho on infrastructure or a database administrator) who executes the Owner’s policy. Custodians configure encryption, maintain audit logs, apply patches, enforce ACLs, and run backup restoration drills, but a Custodian never unilaterally changes a dataset’s classification level.
When personal data (PII/PHI) is involved, privacy regulations introduce two additional roles. The Data Controller is the entity that determines the purposes ("why") and means ("how") of processing personal data. The Data Processor is a separate legal entity (such as a payroll vendor or cloud hosting provider) that processes personal data strictly on behalf of the Controller under a binding Data Processing Agreement (DPA).
| Role | Primary authority | Example at Meridian (chronos.orbital) |
|---|---|---|
| Data Owner | Classifies data, sets access rules, accepts risk, holds accountability. | VP of Orbital Operations classifying flight-command keys as Restricted. |
| Data Custodian | Implements encryption, backups, ACLs, and monitoring per Owner policy. | Kael Cho configuring KMS key rotation and S3 bucket policies. |
| System / Mission Owner | Owns the computing platform hosting one or more datasets and approves system changes. | Director of Ground Station Telemetry managing the telemetry ingestion cluster. |
| Data Controller | Determines the legal purpose and means of processing personal data (PII). | Meridian HR deciding what employee background data to collect for clearance. |
| Data Processor | Processes personal data on behalf of the Controller under a written DPA. | External cloud payroll provider calculating biweekly paychecks for Meridian. |
Government and commercial classification schemes
Data classification groups assets by the impact of unauthorized disclosure or alteration so baseline controls apply automatically. In U.S. government and military contexts, labels measure damage to national security: Top Secret (exceptionally grave damage), Secret (serious damage), Confidential (damage), and Controlled Unclassified Information (CUI) or Unclassified.
In commercial enterprises like Meridian Space & Robotics, classification measures business, competitive, and regulatory harm: Confidential / Restricted (trade secrets, propulsion designs, root signing keys), Private (employee PII, salary records), Internal Use Only (operational runbooks, org charts), and Public (marketing pages, published press releases).
When a single repository or storage volume mixes records of different sensitivities without record-level isolation, the container must be classified and protected at the High-Water Mark: the level of the single most sensitive record stored inside it.
Controls across the six-phase data lifecycle
Data security is continuous across six lifecycle stages: Create, Store, Use, Share, Archive, and Destroy. At Creation (or acquisition), data is classified and tagged with metadata labels so automated controls know how to handle it.
During Storage, data at rest is protected via AES-256 encryption, access control lists, and redundancy. During Use (data in memory or CPU registers), controls include application authorization checks, memory isolation, and confidential computing enclaves. During Sharing (data in transit across networks or to external partners), controls include TLS 1.3, IPsec, API gateways, and Data Loss Prevention (DLP) egress inspection.
During Archival, long-term records move to immutable cold storage with survivable key management that matches legal retention schedules. Finally, at Destruction, expired data is sanitized according to its sensitivity and media type so data remanence cannot betray yesterday’s secrets.
CHECK YOUR JUDGMENT
Meridian Space & Robotics (chronos.orbital) contracts a third-party cloud analytics company to process employee badge-swipe and biometric cleanroom logs solely to generate monthly facility safety reports defined by Meridian. Under privacy and asset governance principles, which role pairing is accurate?
NEXT FIELD LESSON