Services Inventory and Attributes - Data and Information attributes for the Services Inventory

Services Inventory and Attributes

Chapter 19. Data and Information attributes for the Services Inventory

Authored and Published By: The International Foundation for Information Technology (IF4IT), LLC

Executive Summary: Chapter Overview

IF4IT

The Bottom Line

Data and Information attributes capture each Service’s relationship to enterprise data — Data Types Handled, Data Stores Accessed, Data Retention Period, and Data Residency Constraints. These four Walk-maturity attributes connect the Service to the broader Data and Information governance discipline and enable joint analysis of which Services touch which regulated data.

Core Concepts

Concept	Definition & Strategic Role
Data Types Handled	The data and information types the Service consumes or produces — referencing the Data and Information Inventory by Semantic ID for cross-inventory traversal.
Data Stores Accessed	The Data Stores the Service reads from or writes to — supports impact analysis when a data store is impacted or rationalized.
Data Retention Period	How long Service-associated data is retained — supports compliance with retention requirements such as HIPAA, SOX, and contract-mandated retention.
Data Residency Constraints	Geographic constraints on where Service-handled data may reside — supports compliance with GDPR, country-specific data sovereignty laws, and contractual residency obligations.

Quick Q&A

Question: How does Data Residency Constraints differ from the Geographic Coverage attribute in the Geographic and Jurisdictional category?

Answer: Geographic Coverage describes where the Service is offered or available; Data Residency Constraints describes where the Service-handled data must remain. A Service may be globally available (Geographic Coverage: Global) but with EU-only data residency (GDPR-mandated). The two attributes capture distinct dimensions and warrant separate governance discipline.

Question: Why is Data Quality Owner removed from this category in the current attribute list?

Answer: Because most Services do not have a dedicated Data Quality Owner role — the responsibility is distributed across the Service Owner, Data Store owners, and source-system owners. Adding the attribute would create empty fields on most records and provide little governance value beyond what is already captured in Service Owner and Data Stores Accessed.

Read More Below

Data and Information attributes capture each Service’s relationship to enterprise data — the data types handled, the data stores accessed, the retention period, and any residency constraints. These attributes connect the Service to the Data and Information governance discipline.

Attribute Name	Maturity	Description and Notes
Data Types Handled [Multi-Value]	Walk	Description — The data and information types the Service consumes or produces. References the Data and Information Inventory by Semantic ID where the data types are governed there. Benefit(s) — Connects Services to the data they handle. Enables compliance, privacy, and data governance teams to traverse from any data type to the Services that handle it. Source — Manual. Examples — Customer Master Record; Employee Identity Record; Transaction Event; Audit Log Entry Notes — Refer to the IF4IT Data and Information Inventory and Attributes document for the canonical data type taxonomy.
Data Stores Accessed [Multi-Value]	Walk	Description — The Data Stores the Service reads from or writes to. References the planned Data Stores Inventory by Semantic ID. Benefit(s) — Connects Services to the underlying data stores. Enables data governance teams to assess Service-level data store usage, supports data store rationalization decisions, and informs incident response when a data store is impacted. Source — Manual. Examples — DS-CRM-DATABASE, DS-CUSTOMER-DATA-LAKE, DS-AUDIT-LOG-STORE Notes — Refer to the planned Data Stores Inventory and Attributes for data store governance.
Data Retention Period	Walk	Description — The retention period for Service-associated data — how long data the Service handles is retained. Benefit(s) — Supports compliance and privacy governance: which Services retain regulated data, and for how long? Enables retention-policy enforcement. Source — Manual. Examples — 7 years; 30 days (rolling); Indefinite; Per regulatory requirement (record specifics in Notes) Notes — Where the Service handles data subject to specific regulatory retention requirements (e.g., HIPAA, SOX), record the specifics in Notes.
Data Residency Constraints [Multi-Value]	Walk	Description — Geographic constraints on where Service-handled data may reside. Captures regulatory, contractual, or policy constraints on data location. Benefit(s) — Supports compliance with data residency regulations (GDPR, country-specific data sovereignty laws, etc.). Enables data residency reporting across the Service portfolio. Source — Manual. Examples — "EU only (GDPR)"; "US only"; "No restrictions"; "China data must remain in China" Notes — For Services with no residency constraints, "No restrictions" may be appropriate. For Services with multiple constraints, enumerate all.

How to cite this page

When referencing this page in academic work, internal standards, or external publications, include the page title, IF4IT as author and publisher (The International Foundation for Information Technology (IF4IT), LLC), the URL, and your access date.

Example (informal web citation):

The International Foundation for Information Technology (IF4IT), LLC. Data and Information attributes for the Services Inventory | Services Inventory and Attributes. https://if4it.org/best-practices/services-inventory-and-attributes/data-and-information-attributes-for-the-services-inventory/ (accessed 2026-07-23).

See About Us for content governance and site-wide citation guidance.

Legal Disclaimers

💡 The Bottom Line

📝 Core Concepts

🤖 Quick Q&A

How to cite this page

The Bottom Line

Core Concepts

Quick Q&A