Data access governance is the set of rules, owners and reviews that decide who can reach which data, and the evidence that those decisions are followed. It answers four questions: what data exists, who owns it, who can access it today, and who should. Without answers, least privilege stays an aspiration.
What do standards say?
NIST SP 800-53 Rev. 5 groups access controls in its AC family. Account management and least privilege are the two most relevant: grant only the access needed to do the job, and manage the accounts that hold it. These are control statements, not a product. Governance is how you make them true across many systems.
NIST SP 800-162 defines attribute based access control, or ABAC, as authorization decided by evaluating attributes of the subject, object, requested operation and sometimes the environment against policy. It is one way to express governance rules so they scale beyond manual lists.
What are the moving parts?
Classification. A label for how sensitive each dataset is. Rules are written against labels, so unlabelled data falls outside the rules.
Ownership. A named person accountable for each dataset, who approves access and reviews it.
Access model. Roles, groups or attributes that grant access. Role based models are simple. Attribute based models handle context such as department, project, device or time.
Request and approval. A standard route for asking, with the owner's decision recorded.
Review. Periodic recertification where owners confirm each person's access is still needed.
Monitoring. Records of reads, exports and permission changes.
Why does governance fail?
Access accumulates. People change teams and keep old permissions. Shared groups become catch alls. Temporary access never expires. Service accounts hold broad rights because nobody owns them. Data copies, such as exports and extracts, escape the original rules entirely.
Reviews fail when they are too big. An owner asked to confirm four hundred entries approves them all. Smaller, risk ordered reviews work better.
How do you measure whether it is working?
Pick a few numbers that show access getting tighter. The share of sensitive datasets with a named owner. The number of people with access to each top dataset compared with the number who need it. The share of access reviews completed on time. The age of the oldest unreviewed permission. Accounts that are still active after their owner has left. Track them monthly, and expect the first months to look worse, because you are finally counting what was already there.
A constructed example
A company's finance share has grown over six years. A review finds one hundred and forty people with access, though only thirty work in finance. The dataset has no owner. Two former contractors still have read rights through a group.
The fix starts with an owner and a label. The owner recertifies by role instead of person. Access moves from named users to three groups tied to the HR system, so a role change updates access automatically. Contractor access gets an end date. Reads of the payroll folder are logged and a monthly report goes to the owner.
How to check or apply this
- Inventory data stores and rank them by sensitivity. Start with the top ten.
- Assign an owner to each, and write it down.
- Export current permissions and highlight users with broad rights, stale accounts and public links.
- Replace individual grants with groups or attributes linked to an authoritative source, such as HR.
- Add expiry to temporary and contractor access.
- Run a first review on the most sensitive stores, with entries grouped by risk.
- Log reads and permission changes, and send owners a short monthly summary.
- Add a check to onboarding and offboarding so access follows the person.
A sensible first ninety days: days one to thirty for inventory and owners, thirty to sixty for group clean up on the top stores, sixty to ninety for the first review and logging.
Quick check
Is data access governance the same as identity governance?
They overlap. Identity governance manages accounts and entitlements generally. Data access governance focuses on the data, its owners and who reaches it.
Do we need ABAC?
Not to start. Clean roles and groups with owners take you a long way. Move to attributes where role lists become too numerous to manage.
Sources
- NIST SP 800-53 Rev. 5, Security and Privacy Controls
- NIST SP 800-162, Guide to Attribute Based Access Control
- NIST Cybersecurity Framework
Last reviewed: 18 October 2026.
