Active metadata management is a set of capabilities that enables continuous access and processing of metadata that support ongoing analysis over a different spectrum of maturity, use cases and vendor solutions. Active metadata outputs range from design recommendations based upon execution results and reports of runtime steps through, and indicators of, business outcomes achieved. The resulting recommendations from those analytics are issued as design inputs to humans or system-level instructions that are expected to have a response.
Consent and preference management (CPM) platforms support all aspects of collecting, consolidating, synchronizing and applying end-user choices about personal data. The intent is to extend visibility and control to data subjects, enabling them to self-determine how much of their data to expose, to whom and for what purpose. For organizations, CPM platforms provide a strong foundation for compliance-backed data usage, with detailed tracking and auditability. They contribute to a solid consent program, making data monetization easier and more profitable. CPM platforms are delivered via software. Central to most privacy laws is the challenge of giving users clarity around — and control over — their personal data. CPM platforms address this challenge by handling collection, consolidation, synchronization and usage of end-user choices. They empower data subjects with self-determination, enabling them to control how much personal data to expose, to whom and for what purpose. For organizations, CPM platforms provide a strong foundation for compliance-backed data usage, with detailed tracking and auditability. In more fundamental terms, CPM platforms contribute to a solid consent program, making data monetization easier and more profitable.
Corporate Compliance and Oversight (CCO) tools provide the framework and support for standardization of compliance activities and automation to increase efficiency and effectiveness of compliance management programs. CCO enables a common cross-enterprise approach to IT compliance activities that most affect the regulatory oversight of corporate governance. This is done through support of the five major requirements for managing a compliance program: policy development, aggregation and normalization, control monitoring, workflow management, and case management.
Data security posture management (DSPM) provides visibility as to where sensitive data is, who has access to that data, how it has been used, and what the security posture of the data stored or application is. It does that by assessing the current state of data security, identifying and classifying potential risks and vulnerabilities, implementing security controls to mitigate these risks, and regularly monitoring and updating the security posture to ensure it remains effective. As a result, it enables businesses in maintaining the confidentiality, integrity, and availability of sensitive data. The typical users of DSPM include Information Technology (IT) departments, security teams, compliance teams, and executive leadership.
A D&A governance platform is a set of integrated business capabilities that helps business leaders and users evaluate and implement a diverse set of governance policies and monitor and enforce those policies across their organizations’ business systems. These platforms are unique from data management and discrete governance tools in that data management and such tools focus on policy execution, whereas these platforms are used primarily by business roles — not only or even specifically IT roles.
The IT risk management (ITRM) market focuses on solutions that support the ITRM discipline through automating common workflows and requirements. For the purposes of defining this market, IT risks are risks within the scope and responsibility of the IT department. These include IT dependencies that create uncertainty in daily tactical business activities, and IT risk events resulting from inadequate or failed internal IT processes, people or systems, or from external events.
Gartner defines IT vendor risk management (IT VRM) as the discipline of addressing the residual risk that businesses and governments face when working with external service providers, IT vendors and related third parties. The scope typically addresses risks related to data protection, business continuity, security and other risk domains as relevant to laws, regulation and industry practices.
Gartner defines Integrated risk management (IRM) as the combined technology, processes and data that serves to fulfill the objective of enabling the simplification, automation and integration of strategic, operational and IT risk management across an organization.
Legislators motivated by aggressive digitalization and increased consumer concern about the handling of personal data — especially when it comes to AI workloads and data-sharing practices — have passed laws governing consumer privacy rights.1,2,3,4 These rights have become part of consumers’ basic expectations when engaging with commercial organizations or government entities. At the heart of the SRR automation market are three key capabilities: Discovery of existing information held on individuals, and continuous monitoring for changes to data stores and new systems that are being onboarded. Maintenance of the capacity to act on that information should the data subject request modification, deletion or restriction of processing. Tracking of request workflows and holding of detailed records to gauge effectiveness and demonstrate compliance. Organizations face great challenges in sifting through structured and unstructured data stores — whether on-premises, in the cloud, or with partners and subprocessors. In addition to the discovery and retrieval requirement, organizations must redact personal data that is associated with other individuals to ensure they are not violating one user’s rights in order to respond to another. For those reasons, request fulfillment must follow a repeatable and scalable process in order to remain manageable and efficient.
The compliance third-party risk management (TPRM) solutions market consists of vendors offering technologies to CCOs, among other senior leaders responsible for TPRM, to manage the risks associated with due diligence and/or ongoing monitoring of third-party vendors, distributors, agents, partners or other parties. Products in this market are often capable of supporting a range of TPRM workflows across multiple risk terrains. Risks specifically addressed may include anti-bribery and anti-corruption (ABAC), anti-money-laundering, data management and supply chain, and business continuity risks among others.