Security demands lock-down of all datasets while analysts need broader access for service insights. How should governance mediate?
Select an answer to reveal the explanation.
Short Explanation
Not every dataset is a vault, and not every chart needs the vault keys. Classify the data, then match access to sensitivity and purpose. Governance is the referee that lets security and analysts both win on the right plays.
Full Explanation
Balancing protection and enablement is a core governance framework task for cities that must both safeguard data and improve services. When security demands lock-down of all datasets while analysts need broader access for service insights, classification-based access policies should differentiate controls by sensitivity and approved purpose. Granting every analyst unrestricted production admin rights ends the debate by creating unacceptable blast radius. Classifying nothing and relying on informal hallway approvals forever does not scale and fails audits. Removing analytics access permanently so security never has to decide blocks evidence-based civic management. Exam caveat: classification schemes need workable tiers and request paths; over-complex labels that nobody applies are as bad as none. Operational check: adopt a simple classification standard, map it to access patterns, stand up a request-and-approve workflow, and sample entitlements quarterly for least privilege. Security and analytics leaders should co-own the policy so both resident protection and service insight remain explicit goals. Publish a one-page access path so analysts know how to request data without informal workarounds.