Nowadays, data has become a valuable corporate asset of strategic and functional importance. Finding a reliable way to safeguard data is imperative for companies, especially during structural changes when they are most vulnerable. In the process of organizational or structural changes such as joint ventures, mergers & acquisitions, divestitures, and sanctions, organizations need to make changes to not only assets and liabilities, but also digital platforms, intellectual property, and customer databases. Existing security measures, despite their robustness, might be insufficient in covering the drastic changes and expose organizations to grave cybersecurity threats and compliance risks.  

The safeguarding of data in sensitive time of structural changes thus warrants special attention and discussion. The NextLabs white paper, “Safeguarding Data in Joint Ventures, Mergers & Acquisitions, Divestitures, and Sanction”, analyzes cybersecurity challenges and best data security practices for these structural changes, explains the four key pillars to safeguard data, and introduces NextLabs’ approach to address the needs of safeguarding data during organizational structure changes.  

Below is an overview of the paper. For the full explainer, download the paper. 

Challenges in Structural Changes

  • Joint Ventures: Joint ventures are legal structures established by two or more companies that contribute tangible and/or intangible assets to address an opportunity better than each company could do independently. In collaborations like this, employees may have responsibilities to both the joint venture and their company outside of the joint venture. As employees move between the two organizations, it is increasingly complicated yet important to draw boundaries between shared and confidential data for companies. For example, in a joint venture established by company A and B, company A’s employees who work in the joint venture should have access to shared information from company B while prohibited from B’s confidential information. Therefore, it is key to make sure that company data is selectively shared with the joint venture and data access in joint venture are well-defined.  
  • Divestitures: Divestitures face a similar challenge as joint ventures in data access management.  During a divestiture, a single organization is divided into two or more entities to sell part of the business or enable the divested unit to operate independently. While all employees and other assets are divided during the divestment process, it is crucial to define and logically segregate the assets, data, and employees of both the soon-to-be divested unit and the remainder of the organization. Executing logical separation before the physical separation helps organizations to go through the process with more efficiency, less cost, and more room to check identify and address remaining issues before the final separation.  
  • Mergers & Acquisitions: Mergers and acquisitions both refer to a process during which the ownership of companies or their operating units is transferred to other entities. The difference between the two terms resides in that merger refers to the consolidation of two entities into one, whereas acquisition refers to one entity taking over another. The process is time-consuming and complicated, and in the case of data integration, existing databases might need to be manipulated to align with the format they’re merging into. During this process, particular care needs to be taken to provide the right access to employees in companies of both sides. Policies can be utilized to restrict access and modification of the data, for example, through authorizing only a subset of employees to modify data or granting access to employees who have completed necessary training.  
  • Sanctions: Sanctions are political and economic regulations that restrict trade with entities of certain countries, such as increasing tariff to a sanctioned countries and restricting export of certain goods from a country and blocking the sanctioned countries’ ports. Companies that violate these regulations, whether intentional or not, face major penalties. To prevent sanction breaches and comply with regulations, it is crucial to establish an effective data governance program that prevents any sharing or transmission of sensitive data related to sanctions through segregation and access management of business-critical data. 

How to Safeguard Data 

In the major organizational structure changes discussed in the previous section, a shared challenge is the need to safeguard data in response to dynamic environments both internally and externally. The solutions to this challenge should therefore also be dynamic, flexible, and adaptable to changes. Automating policies to dynamically control data access through data segregation, access management, and data masking would be an important means to safeguard data. Equally important is a user-friendly interface that requires no code, enabling data owners and business stakeholders to directly monitor and manage policies in reaction to the latest changes. The white paper outlines four key pillars to meet the requirement of access control, data sharing, data flow, and merging of systems.  

  • Policy Development: Policy development is a fundamental step to develop a dynamic response to the changing environment and the dilemma of sharing and protection of company employees and assets. Having a business-friendly digital policy management system that allows for easy and simple policy development allows for policies to remain up-to-date and ensure sensitive information remains secure. Additionally, using dynamic authorization with attribute-based access control (ABAC) further streamlines the access management process and simplifies user experience. A few policy changes could replace thousands of role assignments to prevent role explosion, and the automation spares the need for a complicated and expensive governance scheme.   
  • Policy Management & Governance: A proper policy governance scheme makes sure that data is safeguarded continuously.  A successful policy management tool facilitates policy governance through ensuring proper lifecycle management of policies, delegated administration, and segregation of duties. All of these aspects warrant only authorized users can modify and create policies, ensuring teams experiencing changes to their organization’s structure, can only access files they are intended to view. 
  • Policy Enforcement: Using ABAC and dynamic authorization, policies can be enforced at runtime to prevent unauthorized access to sensitive data and meet compliance requirements. As each access attempt is evaluated based on attributes like the type of data, user identity, location, and authorized actions, companies can make concise decisions based on real-time information. Leveraging field-level data masking and record-level data segregation, policies can be automated to merge seamlessly into user flows and business processes.  
  • Auditing & Monitoring: The auditing and monitoring process are essential controls for detecting, preventing, and deterring irregularities in an organization. They are vital elements in ensuring regulatory compliance as they evaluate the adequacy and productivity of internal risk controls. Various data privacy regulations require companies to keep track of a variety of information, such as data location, information usage, and access requests. While manual efforts are expensive and error prone, an optimal practice is to automate and streamline the process, which not only simplifies the process and generates error-free reports, but also provides systematic analytics for the management process.  

NextLabs Solution 

To address the needs of enterprises facing major organizational structure changes, NextLabs integrates dynamic authorization and ABAC in its Data Access Security and Application Enforcer families of products to provide fine-grained data security control. Using a multi-layered approach, NextLabs approach help enterprises overcome challenges of safeguarding data and comply with regulations through dynamic data masking and segregation, and access control in a streamlined and automated process.  

To read the full explainer, including more use cases and the NextLabs approach, please download the white paper.