Extend Least Privilege to Data Retention

Security professionals often focus on limiting access to systems—but forget to apply that same discipline to the data itself. When considering data governance in cybersecurity, Javed Ikbal advocates for extending the principle of least privilege beyond access controls to include retention: “Don’t give people access to resources they don’t need, and don’t keep unnecessary data at all.”

This shift requires organizations to build robust data inventories, classify assets by sensitivity, and enforce automated purging for expired or unused records. Addressing data governance in cybersecurity allows for reducing the volume of data held, companies can dramatically shrink breach risk and streamline both security operations and compliance.

Quantify the Hidden Cost of Data

Every piece of data carries risk—and cost. “What’s the worst that can happen to that data if someone comes in unauthorized and steals it?” Javed asks. Instead of viewing storage as cheap and harmless, he encourages leaders to assess the liability tied to different data types, reinforcing the importance of data governance in cybersecurity.

Collaborating with risk and finance teams allows organizations to assign dollar values to categories like customer PII or payment logs. That visibility enables smarter decisions about what’s worth retaining. If the risk outweighs the utility, the data should go. Framing the issue in financial terms helps CISOs make a stronger case for proactive deletion strategies and supports strategic data governance in cybersecurity.

Align Cross-Functional Roadmaps for Retention

Conflicting priorities often stall data cleanup efforts. Marketing wants to keep historical data. Privacy teams push for deletion. Security focuses on liability. Javed recommends solving this with clear collaboration: “The CMO comes with a concrete plan…we put it through security and privacy filters to see if that works or not.”

By co-designing data retention roadmaps across departments, companies gain alignment. Security ensures data is protected, privacy ensures compliance, and marketing gets what it needs—within clearly defined bounds. These joint planning sessions transform data governance from a pain point into a shared strategic win in cybersecurity.

Based on a podcast interview with Javed Ikbal, CISO and Vice President of Information Security & Risk Management at Bright Horizons.

Let’s Go Beyond the Connection — explore more:
🎧 Listen on Captivate
📖 Episode Page on Bigleaf
▶️ Watch on YouTube
📬 Subscribe to the LinkedIn Newsletter