OpenCyber Academy
Postgraduate · Chapter 3 · English
Course code: OCA-141Chapter 03: OCA-141-C003

Chapter 3 — Data ownership in a logistics network

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 03 published. Map, example, EX011.

flowchart TD
  N0["Learning outcomes"]
  N1["3.1 Internal domains"]
  N2["3.2 Partner data"]
  N3["3.3 Ownership statements"]
  N4["3.4 Testing ownership"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX011"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["3.1 Internal domains"]
  N2["3.2 Partner data"]
  N3["3.3 Ownership statements"]
  N4["3.4 Testing ownership"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX011"]
[Learning outcomes]
    |
    v
[3.1 Internal domains]
    |
    v
[3.2 Partner data]
    |
    v
[3.3 Ownership statements]
    |
    v
[3.4 Testing ownership]
    |
    v
[Worked example] --> [Exercise EX011]

Learning outcomes

You will (1) assign ownership across internal and external data; (2) handle data created by partners; (3) write ownership statements.

3.1 Internal domains

Lucía maps Corran's data domains: customers and contracts owned by the sales director, shipments and tracking owned by the operations director, drivers and vehicles owned by the fleet manager and invoices owned by the finance director. Each owner appoints a steward. She finds that tracking events are disputed territory: operations uses them for planning, sales quotes them to customers and finance uses them to support invoices. She proposes operations as owner, since it controls the processes that create the events. The others agree.

3.2 Partner data

Carriers send tracking events for shipments they handle. Corran cannot control how carriers capture events, but it decides how those events are used. Lucía distinguishes ownership of the source, which stays with the carrier, from accountability for Corran's use of the data, which belongs to the operations director. She notes that governance for partner data works through agreements and monitoring rather than direct control, which later chapters on third-party data develop further. Lucía records this distinction in each owner's statement for clarity.

3.3 Ownership statements

For each domain Lucía writes a one-page ownership statement: the data covered, decisions the owner makes, the steward, key quality expectations and escalation routes. The operations director's statement includes approving tracking quality rules and deciding when carrier data are reliable enough to support customer claims. Owners review and sign their statements. She notes that writing decisions explicitly reveals gaps, such as nobody having authority to approve new data uses. The governance group assigns that authority to the relevant domain owner, with legal advice where needed.

3.4 Testing ownership

To test whether ownership works, Lucía brings a real type of question to each owner: may sales share tracking histories with a customer's insurer? The operations director decides with input from legal, and the decision is recorded. She notes that ownership becomes real only when owners actually make decisions, and that early test questions help owners practise their role before more difficult cases arrive under pressure. Lucía runs one such test question with each owner during the first quarter, and records each decision in a shared log for later reference.

Worked example

Lucía maps four domains, assigns contested tracking events to operations, separates partner source ownership from accountability for use, writes signed ownership statements and tests them with an insurer sharing question.

Synthetic case. Ownership assignments are synthetic.

Errors and limits

Assigning ownership to whoever uses data most ignores who controls its creation.

Exercises

Worked answers

EX011. The operations director.

EX012. Ownership of how the source data are captured.

EX013. Nobody had authority to approve new data uses.

EX014. Whether sales may share tracking histories with a customer's insurer.

EX015. The owners themselves.