GOVERNANCE

Know what access allows.

Document the people, applications and partners that can use a dataset, and what happens when permission changes.

Give each control an owner.

Pair entitlement, expiry, output policy and monitoring with someone who can produce an audit record. Open Sharing Readiness.