The first scan always finds something. It finds databases nobody listed, file shares full of personal data, and exports in cloud storage. The report goes to a steering group and everyone agrees to act. Six months later the findings are still open, the labels cover a fraction of the estate, and the next scan finds the same things again. This is where most discovery and classification programs stall.
The reason is not the scanner. It is that discovery produces a list and classification produces a label, and neither changes how data is handled unless someone owns the next step.
What the standards ask for
| Source | Requirement in substance |
|---|---|
| NIST CSF 2.0, ID.AM-07 | Inventories of data and corresponding metadata for designated data types are maintained |
| NIST CSF 2.0, ID.AM-05 | Assets are prioritized by classification, criticality, resources and impact on the mission |
| NIST CSF 2.0, PR.DS-01, -02, -10, -11 | Confidentiality, integrity and availability of data at rest, in transit and in use are protected; backups are created, protected, maintained and tested |
| UAE PDPL (Decree-Law 45 of 2021), Article 7(4) | The controller keeps a record of processing that includes who is authorized to access data, erasure mechanisms, cross-border transfers and security measures |
| UAE PDPL, Article 21 | A data protection impact assessment is required where large volumes of Sensitive Personal Data are processed |
| CBUAE C 1/2026, Article 1.9 and 8.6.3 | Critical Information Assets are defined; the ICT and cybersecurity policy must cover Critical Information Asset protection and information classification |
Our reading: every one of these asks for a maintained inventory tied to a decision, not a one-off scan. A record of processing that was last updated at the first scan does not meet the intent.
Why programs stall: five causes
-
No owner for each finding. Discovery finds data; the business owns it. If a finding has no data owner with authority to fix or accept it, it stays open.
-
Labels with no consequence. A classification label that does not change access, sharing or retention is decoration. Tie each level to specific handling rules.
-
Scope that never closes. Structured databases are easy; file shares, collaboration tools, SaaS exports and logs are not. Choose scope by data value, not by what the tool scans easily.
-
Data moves. New stores appear with every project. A scan is a snapshot. Without discovery in the change process, the inventory ages from the day it is made.
-
Accuracy is never tested. Classification tools produce false positives and misses. Nobody measures either, so nobody trusts the output.
Why the stakes are concrete
In the Equifax breach, the House Oversight report says the application needed access to only three databases, yet the attackers used its credentials to reach 48 unrelated databases, ran about 9,000 queries and located personally identifiable information 265 times. Our reading: an accurate data inventory with owners and handling rules is the starting point for deciding which stores deserve segmentation and monitoring. It does not replace those controls.
In the Capital One consent order, the OCC finds that the bank failed to establish adequate data loss prevention controls in its cloud environment, among other findings. A DLP control depends on knowing what data to protect.
A program that keeps going
| Stage | Output | Test of success |
|---|---|---|
| Scope | List of data types and systems in scope, ranked by value and obligation | Board or risk committee has agreed the ranking |
| Discover | Inventory with metadata and an owner for every store | No store without an owner |
| Classify | Labels mapped to handling rules | A label changes access or sharing in at least one enforced control |
| Act | Findings routed to owners with due dates | Median time to close; items past due |
| Sustain | Discovery in change control; periodic re-scan; accuracy sampling | Share of new stores found by process, not by chance |
Decision
Decision: stop reporting ‘terabytes scanned’. Report the share of high-value stores with an owner, a label and an enforced handling rule. Two numbers drive the program: stores without owners, and findings past due.
What this evidence does not show
The Equifax and Capital One cases show what happens when data protection controls fail. They do not show that classification programs would have prevented either breach. We did not cite vendor accuracy rates or industry survey figures on classification adoption. The stage table is Cybrilliant analysis.
A short test
Take your most sensitive dataset. Name the owner, the label, the rule that label triggers, the control that enforces it and the date of the last re-scan. A missing item is where the program has stalled.
Sources
-
NIST Cybersecurity Framework 2.0 (CSWP 29), 26 February 2024. Accessed 9 October 2026. nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf
-
UAE Federal Decree-Law No. 45 of 2021 (Personal Data Protection), UAE Legislation portal. Accessed 9 October 2026. uaelegislation.gov.ae/en/legislations/1972
-
Central Bank of the UAE, Operational Risk Management Regulation C 1/2026, Rulebook. Accessed 9 October 2026. rulebook.centralbank.ae/en/rulebook/operational-risk-management-regulation
-
US House Committee on Oversight and Government Reform, Majority Staff Report, The Equifax Data Breach, December 2018. Accessed 9 October 2026. oversight.house.gov/wp-content/uploads/2018/12/Equifax-Report.pdf
-
OCC Consent Order No. 2020-036 (Capital One), signed 5 August 2020. Accessed 9 October 2026. occ.gov/static/enforcement-actions/ea2020-036.pdf
How we label evidence
Facts carry a source. Analysis and recommendations are marked as ours. Examples that are hypothetical are labeled as hypothetical.
Part of the solutionProtect What MattersGuard the identities, data and systems the business depends on.See how we work →Related service
Data Security as a Service
Use this to turn a one-off data discovery scan into a loop with owners, labels and remediation.