Jeff Crume outlines five data-security capabilities in this 12-minute IBM Technology explainer.

See and classify the data

  • Visibility: map sensitive data across endpoints, on-premises systems, cloud services, and network transfers, including who uses it and why.
  • Classification: automatically identify sensitive information before AI consumes it, and keep labels current as data arrives and moves.
  • Match protections to sensitivity so controls neither leave critical data exposed nor obstruct every use equally.
  • Residency describes where data is stored; sovereignty concerns the laws and authorities that apply.
  • Localization can require storage and processing within a particular country or region.
  • Check processing locations as well as storage locations, and have legal counsel review cross-border arrangements.

Control access and preserve evidence

  • Administration: provision, approve, and remove accounts using least privilege.
  • Authentication: establish identity through mechanisms such as passkeys and multifactor authentication.
  • Authorization: decide which actions that identity may take, using roles and contextual conditions.
  • Audit: continuously log data movement and AI use, preserve tamper-resistant records, and make them available for review.

What the checklist covers

  • Auditors need to know where data went, who accessed it, what they did, and which AI workload used it.
  • Caveat: this is a foundational governance checklist. Actual AI deployments also need workload-specific security testing and verified enforcement.

“Residency is asking that question, where is my data? And sovereignty is asking, whose laws control my data?” — Jeff Crume, 5:48