Entity

Privacy Data Inventory

The catalog of personal and sensitive data across systems — containing data categories, storage locations, retention periods, processing purposes, and the data subject rights fulfillment status.

Last updated: February 2026Data current as of: February 2026

Why This Object Matters for AI

AI cannot mask data appropriately or fulfill deletion requests without a privacy inventory; without it, 'where is this person's data' requires searching every system manually.

Technology & Data Management Capacity Profile

Typical CMC levels for technology & data management in Financial Services organizations.

Formality
L2
Capture
L2
Structure
L2
Accessibility
L2
Maintenance
L2
Integration
L2

CMC Dimension Scenarios

What each CMC level looks like specifically for Privacy Data Inventory. Baseline level is highlighted.

L0

Network Configuration F0: Network configs in engineers heads; SWIFT zone configs undocumented.

Can do nothing for financial services networks.

Document configs for trading and payment network configurations.

L1

Network Configuration F1: Configs in text files with inconsistent formats across trading and payment networks.

Can read text configs for financial services networks.

Standardize format for trading and payment network configurations.

L2Current Baseline

Network Configuration F2: Configs in version control but manual updates; payment gateway rules not linked to change management.

Can track config versions for financial services networks.

Add validation rules for trading and payment network configurations.

L3

Network Configuration F3: Structured configs with validation; SWIFT CSP zone rules enforce segregation automatically.

Can validate compliance for financial services networks.

Implement automation for trading and payment network configurations.

L4

Network Configuration F4: Config schema with automated testing; payment network changes validate against security policies.

Can automate testing for financial services networks.

Deploy ML-driven optimization for trading and payment network configurations.

L5

Network Configuration F5: AI-driven config optimization; SWIFT zone rules self-update from threat intel and compliance changes.

Can autonomously manage network configs.

Ceiling of the CMC framework for this dimension.

Capabilities That Depend on Privacy Data Inventory

Other Objects in Technology & Data Management

Related business objects in the same function area.

IT Asset Inventory

Entity

The comprehensive registry of all IT assets — servers, workstations, network devices, cloud instances, and software with specifications, patch levels, owners, and the relationships that form the configuration management database.

Security Threat Intelligence

Entity

The curated collection of threat indicators and attack patterns — containing IOCs, CVEs, threat actor profiles, and the risk contextualization that helps security teams prioritize responses.

IT Service Ticket

Entity

The transactional record for each IT incident or service request — containing issue description, affected system, priority, resolution steps, and the time-to-resolution metrics that drive service level performance.

Data Quality Score

Entity

The measured assessment of data quality for critical data domains — containing completeness, accuracy, timeliness, and consistency metrics with thresholds that trigger remediation when quality degrades.

Data Catalog Entry

Entity

The metadata record for each data asset — containing data definitions, lineage, ownership, classification, usage statistics, and the access controls that govern who can see and use each dataset.

Software License Record

Entity

The managed inventory of software entitlements — containing license types, quantities, deployment counts, renewal dates, and the compliance position showing over- or under-deployment.

Code Repository

Entity

The version-controlled collection of source code and configurations — containing code files, commit history, branch structure, pull request reviews, and the quality metrics that track code health.

Disaster Recovery Plan

Entity

The documented recovery procedures for each critical system — containing recovery time objectives, recovery point objectives, failover procedures, test results, and the dependencies that determine recovery sequence.

Patch Deployment Decision

Decision

The recurring judgment point where IT operations evaluates which patches to deploy — weighing vulnerability severity, exploit availability, system criticality, and change window constraints to prioritize patching efforts.

What Can Your Organization Deploy?

Enter your context profile or request an assessment to see which capabilities your infrastructure supports.