ATF Data Governance Policy.pdf

U.S. Department of Justice Bureau of Alcohol, Tobacco, Firearms and Explosives Order

ATF O 7231.1

SUBJECT: ATF DATA GOVERNANCE POLICY DATE: 06/05/2024

OPI: 300000

OPI RECERTIFICATION

DATE: 06/05/2029

ATF O 7231.1

06/05/2024

FOREWARD

TO: All ATF and Contract Employees

1. PURPOSE. This order establishes the policy framework for technical and behavioral standards and guidelines regarding the creation and management of ATF data, especially in relation to data quality and consistency, security, compliance, and access by individuals. It assigns responsibilities to offices and individuals regarding management and governance of data.

Data governance is a central element of a successful business process and developing strategies, standards, and policies provides for the better stewardship of data, protection of information assets, and guides Directorates on maintaining information so that quality data is available for operations and analytics.

2. REFERENCES.

a. ATF O 7231.2, ATF Data Governance Board Charter

b. ATF Data Governance Footprint

c. ATF Data Governance Definitions

d. ATF Data Governance Roles by Systems

e. IT Structural Manual

3. MODIFICATION AND TERMINATION. This policy expires at the discretion of the ATF Chief Information Officer. The policy will be reviewed annually for continued relevancy and can be modified as deemed necessary by the ATF Data Governance Board.

4. QUESTIONS. Questions regarding this order should be directed to the Chief Data Officer.

Assistant Director (Office of Science and Technology) CIO

ROGER BEASLEY

Digitally signed by ROGER

BEASLEY

Date: 2024.06.05 12:47:35 -04'00'

TABLE OF CONTENTS

PAGE

CHAPTER A. INTRODUCTION 5

CHAPTER B. DATA GOVERNANCE FRAMEWORK

1. Core Elements 6 2-10 Reserved 6

CHAPTER C. ACTIVITES AND BENEFITS OF DATA GOVERNANCE

11. Benefits of ATF Data Governance 7

12. Benefits of ATF Data Standardization 7

13. Data Governance Activities 7 14-20 Reserved 7

CHAPTER D. GOALS

21. Establish Governance Structure 8

22. Define and Communicate 8

23. Monitor and Enforce Compliance 8

24. Define Primary Operational Roles 8 25-30 Reserved 8

CHAPTER E. STAKEHOLDERS

31. ATF Program Staff and Leadership 9

32. External Governmental Agencies, Industry Members, and Public/Private Entities9

33. ATF’s Chief Data Officer 9

34. ATF’s Senior Leadership 9

35. ATF’s Data Governance Board 9 36-40 Reserved 9

CHAPTER F. DATA GOVERNANCE ROLES

41. Executive Sponsor 10

42. ATF Data Governance Board 10

43. Data and Product Owners 10

44. Data Custodians 10

45. Data Stewards 10

46. Subject Matter Experts 10 47-50 Reserved 10

CHAPTER G. DATA STEWARDSHIP

51-60 Reserved 11

CHAPTER H. DATA GOVERANCE FOOTPRINT

61-70 Reserved 12

CHAPTER I. POLICY AND GUIDELINES STATEMENT

71. Standards and Rules 13 72-80 Reserved 13

CHAPTER J. DATA MANAGEMENT TECHNOLIGY AND TOOLS SET

81. Database and Reporting Technologies 14

82. Client Tools and Technologies 14 83-90 Reserved 14

CHAPTER K. DATABASE DEVELOPMENT LIFE CYCLE

91-100 Reserved 15

CHAPTER L. EXISTING DATA GUIDELINES

101. Requirements 16 102-110 Reserved 16

CHAPTER M. DOJ NEW DATA ACQUISITIONS GUIDELINES

111. New Data Projects 17

112. Production Phase 17 113-120 Reserved 17

CHAPTER N. STANDARD DATABASE DESIGN

121. Design Overview 18

122. Security 18

123. Naming Standards 18

124. Data Retention 18 125-130 Reserved 18

CHAPTER O. NAMING GUIDELINES

131. Standards 19 132-140 Reserved 19

CHAPTER P. OFFICE OF THE CHIEF DATA OFFICER

141-150 Reserved 20

CHAPTER A. INTRODUCTION

The value of data as a resource is increased through its governance, stewardship, and appropriate use. Its value is diminished through misuse, misinterpretation, or failure to maintain quality. Most importantly, access to quality data and its appropriate analytical use will enable ATF to identify new relationships in data. ATF is committed to establishing and maintaining data standards and quality, while adhering to all compliance requirements, including relevant information security concepts and constructs.

Data standards are the rules by which data is described and recorded. Data format must be standardized for successful interpretation and use. The designated system owner(s) of individual systems own the data and are largely responsible for data quality. The Office of Science and Technology (OST) is responsible for storing and accessing data in a secured and efficient way.

OST, in coordination with individual system owners, will identify future needs to add/modify data standards.

Data governance is not a technology function, rather, it is driven by the business process and forms a bridge between business management and technology providers. Executive sponsorship comes from the business process. Data governance and data stewardship represent collaborations of business subject matter experts and the information architecture staff.

ATF will develop policies and implement formal procedures to maintain data integrity, protect existing data, maintain data quality, achieve legal compliance, and ensure data security.

Additionally, ATF will incorporate Data Life Cycle Management (DLM), a policy-based approach to managing the flow of an information system's data throughout its life cycle: from creation and initial storage, to the time when it becomes obsolete and decommissioned.

CHAPTER B. DATA GOVERNANCE FRAMEWORK

Data Governance Framework is a logical structure for classifying, organizing, and communicating complex activities involved in making decisions about, and acting on, enterprise data. The Data Governance Framework includes the intersection of, and relationship with, data integrity and quality, metadata management, knowledge management, and master data management for a comprehensive information management strategy administered by data stewards.

The Data Governance Framework represents the desired future-state needed to address the problems that compromise ATF’s data assets today.

1. CORE ELEMENTS

a. Why: the mission and purpose

b. What: the goals of the program

c. Who: the people involved

d. When: the stages of the process

e. How: the rules and definitions

2-10 RESERVED

CHAPTER C. ACTIVITIES AND BENFITS OF DATA GOVERNANCE

Data governance activities are applicable to Systems Life Cycle (SLC) processes. They facilitate successful Data governance for each project under the requirements of ATF’s SLC policy. Establishing and enforcing data standards are part of data governance activities.

Additionally, Data governance helps manage data and information assets and assists in making more effective, analytical use of both. The realization of data as a valuable and manageable organizational asset is a significant benefit of ATF’s data governance initiative. ATF carefully manages other assets (financial, physical, and human) and will do the same with the development of this data governance policy to take advantage of the immense value of data.

11. BENEFITS OF ATF DATA GOVERNANCE

a. Easy change management

b. Ensure proper data domain

c. Accurate and consistent master data access

d. Enable simple governance

12. BENEFITS OF ATF DATA STANDARIZATION

a. Improved data quality

b. Increased data compatibility and lineage

c. Improved consistency and increase efficiency of data acquisition/retention

d. Reduced data redundancy

e. Improved data access, knowledge, and data sharing to reduce silo data approaches

f. Ensure legal compliance

13. DATA GOVERNANCE ACTIVITES

a. Guidelines and methods for effective data planning from inception to completion

b. Data access procedures and Application Programming Interface (API) standards

c. Data domain and data type standards

d. Data models, source to target mapping, and data dictionary

e. Data analysis, data integrity, and quality checks

f. Reference data and master data management

g. Subject Matter Expert (SME) consultation, design review, and user education

14-20 RESERVED

CHAPTER D. GOALS

21. ESTABLISH GOVERNANCE STRUCTURE, INCLUDING RESPONSIBILTY AND

AUTHORITY

22. DEFINE AND COMMUNICATE

a. Enterprise data architecture

b. Framework

c. Data Standards

d. Data Domain Classifications

e. Data Integrity and Quality

f. Data Access and Security

g. Data Compliance

h. Legal Compliance

23. MONITOR AND ENFORCE COMPLIANCE

24. DEFINE PRMARYOPERATIONAL ROLES for execution of data governance, to include identification of responsible parties

25-30 RESERVED

CHAPTER E. STAKEHOLDERS

Strategic planning for data changes involves parties who play an important role across the lifecycle of data. Notable stakeholders who can provide input toward improving ATF data include:

31. ATF programs staff and leadership, who define and collect statistical, administrative, budget, and transactional data, and use it to guide program administration.

32. External governmental, industry members, and public and private entities who depend on ATF data to support their work, support collaborative efforts, and identify patterns and trends that optimize data informed decision-making.

33. ATF’s Chief Data Officer (CDO) who leads and champions data-driven strategies, initiatives, and practices within the organization. The CDO’s mission is to unlock the full potential of data to enable strategic decision-making, enhance operational efficiency, and drive organizational success.

34. ATF’s senior leadership, who provide vision and priorities for Bureau programs, use data to monitor program impact and performance on stakeholders and beneficiaries, and support sound resource allocation.

35. ATF’s data governance body (Data Governance Board) and network of data stewards, who promote the value of, and advocate for, more optimal data governance, and ensure that data management and governance processes stay aligned with supporting ATF’s mission.

36-40 RESERVED

CHAPTER F. DATA GOVERNANCE ROLES

41. EXECUTIVE SPONSOR: An executive sponsor is a member of senior leadership who has planning and policy responsibility and accountability for major administrative data systems within their functional areas. By understanding the planning needs of the Bureau, they can anticipate how data will be used to meet ATF’s needs. Any initiative that cuts across ATF’s lines of business must have executive management support and funding.

42. ATF DATA GOVERNANCE BOARD: The ATF Data Governance Policy, like any other over-arching enterprise architecture, depends upon setting and maintaining the standards and rules on which the data policy is founded. The Data Governance Board undertakes the custodianship of the enterprise architecture. Data owners, data stewards, and enterprise management from the various ATF business domains make up the membership of the board. The ultimate purpose of the Data Governance Board is to establish and maintain the standards and rules governing the data governance policy. A separate charter has been established to thoroughly outline the specific roles and responsibilities of the Data Governance Board.

43. DATA AND PRODUCT OWNERS: Data and product owners are system owners or program managers who have authority to determine business definitions of data, grant access to data, and approve the secure usage of data for the functional areas within their delegations of authority. By understanding the information needs of the Bureau, data owners can anticipate how ATF data can be used to strategically meet the Bureau’s mission and goals.

44. DATA CUSTODIANS: Data custodians are responsible for the operation and management of technology and systems that collect, store, process, manage, and provide access to ATF data. Data custodians typically are associated with technical functions but can also include systems administrators within all functional areas.

45. DATA STEWARDS: Responsibility and authority for the day-to-day management of one or more types of ATF data. Data stewards authorize and monitor the secure use of data within their functional areas to ensure appropriate access, accuracy, classification, privacy, and security.

46. SUBJECT MATTER EXPERTS: A Subject Matter Expert (SME) is an individual within a business unit, or the analyst assigned to the business unit, that has the most complete understanding of a particular subject area or process. The SME is engaged to make sure that the right data is being used appropriately to meet business needs for both transaction processing and reporting purposes. A SME can also be a data steward but does not have to be.

47-50 RESERVED

CHAPTER G. DATA STEWARDSHIP

Data stewardship is the function that initiates and controls the execution of the ATF data governance policy. Data stewards are those individuals charged with the careful and responsible management of metadata and data entrusted to their care. Stewards are not the owners of the data; they are responsible for ensuring that the data and its metadata are accurate, accessible, usable, and current and that established data policies are followed.

The data stewards act as the conduit between IT and the business or program office. For ATF, the data stewards will act as the conduit between OST and the program areas, representing the needs of ATF as well as the industries we regulate. The data steward aligns the business needs with the enterprise systems, providing both decision and operational support. The data steward has the challenge of ensuring that ATF’s data is used to its fullest capacity in support of the Bureau’s mission.

51-60 RESERVED

CHAPTER H. DATA GOVERANCE FOOTPRINT

Please reference the stand-alone document, ATF Data Governance Footprint, for the diagram of all External Data Sources, ATF Data Source Systems, and the resulting Applications.

61-70 RESERVED

CHAPTER I. POLICY AND GUIDELINES STATEMENT

The ATF Data Governance Board will prepare and recommend relevant data governance policies for vote as outlined in the Data Governance Board Charter. Additionally, the Data Governance Board will establish the necessary control and enforcement mechanisms.

All data created and maintained by ATF is owned by the U.S. Government. The access to data, reports, and other related output is governed according to ATF policies and guidelines.

Individuals and/or departments function as the stewards of the data and are responsible for proper application of ATF policies and guidelines.

ATF’s CDO will oversee the long- and short-term strategic goals on the management and governance of data retention, integration, and orchestration of the data footprint in ATF. The purpose of this guideline is to create standard operations and enforce those standards on ATF managed data and application infrastructure. The Office of the Chief Data Officer (OCDO) is committed to a unified strategy on the data sources, data extractions, retention, and access management through robust framework and easy to navigate guidelines for data use, as well as providing scalable and sustainable solutions.

The Data Governance and Policy Branch will review existing projects and make decisions with minimal impact on existing data and databases. The Data Governance and Policy Branch will not dictate how and what data is captured or stored if data sets captured and acquired are unique. The OCDO will review the process, entities, and attributes developed to make sure they are complete, linked/linkable, and traceable.

The primary goal of governance is to ensure projects use preferred tools and technology, follow the guidelines on development, build security as per needs, achieve legal compliance, develop standards for common framework for different projects, and have the ability to recreate data sets when possible. The secondary goal is to ensure data integrity and quality is maintained throughout the data cycle, create a knowledgebase of data collected, ensure there are no duplications, and that no new definitions are created for existing data.

71. STANDARDS AND RULES ARE APPLICABLE TO:

a) Data Management System and Toolsets

b) Database Development Lifecyle and Governance

c) Enterprise Data Management and Standards

72-80 RESERVED

CHAPTER J. DATA MANAGEMENT TECHNOLOGY AND TOOLS SET

81. DATABASE AND REPORTING TECHNOLOGIES

ATF data will be managed using database and reporting technologies as approved by the Chief Technology Officer (CTO), otherwise a waiver must be requested.

82. CLIENT TOOLS AND TECHNOLOGIES

ATF will use tools and technologies for development efforts and data analytics platforms that comply with currently approved tools as defined by the CTO, otherwise, a waiver must be requested.

83-90 RESERVED

CHAPTER K. DATABASE DEVELOPMENT LIFE CYCLE

The OCDO’s Data Governance and Policy Branch must be formally notified of a new project, project changes, and enhancement of any data related requirements. The Data Governance and Policy Branch will review the requirements, scope of the project, complete impact analysis, and provide oversight. The Data Governance and Policy Branch will review planned data activities, understand context, and suggest improvements if applicable. The database design must follow OCDO's specification on standards, naming conventions, interpretations of data, source to target mapping, backup plans, and access control. A point of contact for answering questions should be provided for each project or initiative.

The Data Governance and Policy Branch has standards in place on the naming conventions, data definitions, retention, and security for new data, as well as domain applicability. It is expected that development teams follow the established naming conventions and domain applicability model to standardize the data intake process and map to the respective domain.

These tasks are governed to optimize consistent outcomes and provide a clear understanding of data products and applications. Projects will proceed to the next phase upon satisfactory completion of all requirements.

91-100 RESERVED

CHAPTER L. EXISTING DATA GUIDELINES

101. REQUIREMENTS

a) Develop artifacts sharing and high-level architecture of information flow

b) Ensure integrity and reusability without losing the original concept and meaning of the data

c) Define data needs on the domain, entity, and attribute level

d) Share data objects, when possible, without duplicating or renaming exclusively for an individual application use

e) Build and audit mechanisms within projects and applications for tracking historical records when they are modified in source applications

f) Backup plan (Database Back-up) for review (security measures will be reviewed including, access, disaster recovery, roles-based access, and data security such as obfuscation)

g) Submit data domain applicability, naming conventions, operation guidelines, and security guidelines to the Data Governance and Policy Branch for review

h) Changes in data standards need only be applied to future records from the change approval date forward

i) Ensure data integrity (constraints, object, and complete data migration) is fully validated in lift and shift migrations. This is true for migrations within same database types or from one Database Management System (DBMS) system to another. The Data Governance and Policy Branch can request the metrices and tested criteria, as well as outcome, before signing off on the migration

j) Existing Data projects must not define new data definitions redundantly or reproduce in cases where one already exists

k) Ensure compliance with legal and policy data restrictions

102-110 RESERVED

CHAPTER M. DOJ NEW DATA ACQUISITIONS GUIDELINES

111. NEW DATA PROJECTS

a) Develop artifacts sharing and high-level architecture of information flow from proposed new data sources

b) Define data attributes and data type for new source systems, unless similar data already resides within an ATF database environment

c) New data projects are required to follow the requirements set forth in the IT Structural Manual

112. PRODUCTION PHASE

The development/application team should document source to target mapping, data definitions, data management requirements, and change tracking. Changes and enhancements requested after the deployment by the product owner or application owner need to be reviewed and properly signed off by the data governance team. The Infrastructure/Database Administrator (DBA) team can make some changes to the database infrastructure to give more stability and performance (for example add space, add index, add concurrent user counts, add users, service accounts) but cannot make any changes related to actual data or object structure. Any changes required to the databases’ structure, data, and logical changes, and data definitions must be signed off by a data governance analyst working on that project.

113-120 RESERVED

CHAPTER N. STANDARD DATABASE DESIGN

121. DESIGN OVERVIEW

The design standards define the steps necessary to evolve a logical data model into physical schema and table structures. When creating a physical database, all standards outlined in this guideline must be followed. The infrastructure team is responsible for creating the database instance and controlling the access according to the project needs and available resources. Once the database is created, all objects are created in the lower environment by the development team.

122. SECURITY

The development team needs to identify security requirements for the project/ enhancement needs. This includes the role-based access, data management (back-up, and restore), data retention policy, and data obfuscations needs. The project should outline the frequency of the data required to be replicated in lower environments and special needs in the project plan. The Data Governance and Policy Branch will allocate the resources and ensure these requests and specific needs are standard; special needs will be discussed and finalized with the working committee.

123. NAMING STANDARDS

Naming conventions are designed to meet the following objectives.

a) Guarantee the uniqueness of database object names within the database

b) Provide a uniform naming structure for the database objects of similar types

c) Simplify the database design decisions regarding the naming conventions among different projects

d) Avoid ambiguity, spend less time identifying objects, and enable efficient data management

124. DATA RETENTION

The ATF Records Control Schedule is issued under ATF O 1340.7A. It is a comprehensive agency records schedule that includes all records series descriptions, retention periods, and disposition instructions that have been authorized for ATF use.

Many of the Bureau’s records result from activities that are carried out or facilitated by electronic information systems. ATF is required to identify records produced by these systems and schedule their retention and disposition.

125-130 RESERVED

CHAPTER O. NAMING GUIDELINES

131. THE FOLLOWING STANDARDS SHOULD BE FOLLOWED FOR ALL PROJECTS

Naming guidelines and standards should be adhered to as outlined in the Data Governance Handbook.

132-140 RESERVED

CHAPTER P. OFFICE OF THE CHIEF DATA OFFICER

The Office of the Chief Data Officer’s primary mission is to lead and champion data-driven strategies, initiatives, and practices within the organization. The OCDO's mission revolves around unlocking the full potential of data to enable strategic decision-making, enhance operational efficiency, and drive organizational success.

The work of the OCDO is guided by the Data Governance Board, those managing the Bureau’s strategic goals, and those using data to achieve the strategic goals.

ATF creates a large amount of data across all directorates. The OCDO along with the Data Governance Board, its charter, and this policy, will work to ensure standardization in data, its management, and its use.

141-150 RESERVED