ISO Guidance of the Management of Data Assets

In July 2024 the International Standards Organisation released standard ISO 55013 - "Asset management — Guidance on the management of data assets". Part of the ISO 55000 series, which focuses on asset management in general, ISO 55013 concentrates specifically on managing data assets. The standard aims to "give guidance on the management of data when applying asset management principles or requirements for an asset management system".

As usual ISO have produced a clear and well articulated standard, but seven things stood out for me in particular.

First, the standard makes clear that while its focus is on managing data for asset management it acknowledges that organisations "can manage the data as an asset to support their organisational management". Indeed the standard states that data itself can be managed as an asset using the principles of asset management outlined in other standards in the ISO 55000 series.

Second, the standard makes a useful distinction between "asset data" and "data assets". Asset data is the term used to "refer to data that lists and describes an asset", while data asset "is used to refer to collections of asset data that has the properties of an asset". It is this latter category of asset - "data assets" - that can be managed using the principles of asset management.

Third, the standard highlights how data is similar to and different from physical assets…

• Life cycle: like physical assets, data has a lifecycle and its usefulness can change over time.
• Theft: while data can be stolen, theft does not result in data loss, so it is not always immediately obvious despite the potential to cause organisational harm.
• Duplication: data is easy to duplicate and transport, but not easy to recreate if lost or compromised.
• Multiple uses and users: data can be used by multiple people for multiple purposes simultaneously.
• Value creation: data creates value either directly or when combined with other assets, including other data assets.
• Volume management: using data often leads to the creation of more data, all of which has to be managed.
• Business integration: data and information are foundational resources for business operations and decisions.

Fourth, the standard talks explicitly about the wide range of ways in which data can be created…

• Data entry: from apps, websites, and mobile devices.
• Transactions: Via electronic data interchange (EDI).
• Sensors: From IoT devices and machine sensors.
• New Context: Combining data for new insights.
• Subscription: From data feeds or virtual stores.
• Time Sensitivity: Data with expiration dates.

Fifth, the standard outlines the fundamental steps in the lifecycle of a data asset, including:

• Define: Establish form, structure and meaning of the data.
• Collect: Acquire and gather data.
• Store: Locate for retrieval, including virtual storage.
• Report: Analyse for decision-making.
• Decide: Make decisions based on evaluation, including those made through automation.
• Distribute: Circulate data externally - including formal reporting, as well as sale of data.
• Dispose/Archive: Remove obsolete data.

Sixth, the standard identifies a range of factors that indicate when data sets should be treated as data assets, including:

• High Value/Risk: data that requires ongoing management.
• External Sources: data purchased or acquired.
• Multiple Platforms: data used across multiple platforms or technologies.
• Cross-Referencing: data that is needed for cross-referencing across data assets.
• Longevity: data related to assets that will outlast the technology on which data is stored.
• Regulatory Changes: where regulatory and legislative changes require coordinated change across data sets.
• Inconsistencies: overlapping processes that increase the risk of data inconsistencies.
• Obsolescence: data stored in formats that may become outdated.
• Organisational Changes: data that may be impacted by organisational changes.

Seventh - and perhaps most critically - the standard ducks the question of data valuation completely. In describing its scope, the standard states:

• "This document does not provide methodologies to derive or appraise value for data assets.
• This document does not provide methodologies to derive financial values for data assets.
• This document does not provide direction to organisations on the need (or not) for calculating financial values for asset data".

This seems like a missed opportunity. The standard makes a powerful case for managing data assets. Most leaders reading the standard will immediately be drawn to the question - where do we start? We have so many data assets, how do we know which ones to prioritise and work on first. Data valuation would guide this, ensuring the organisation works on the most important data assets first. So hopefully the next iteration of ISO 55013, or perhaps a sister standard, will have something to say about the critical question - how do we value our data assets so we can decide which ones to prioritise as we seek to build a data asset management system.

Reference: ISO 55013 - Asset management — Guidance on the management of data assets