ISC, Information Systems and Controls
Sources for Data Management: Lifecycle, Relational Structure, and Integrity
Last reviewed
The standards and authorities behind PocketCPA's ISC lessons on Data Management: Lifecycle, Relational Structure, and Integrity. The topic rests on Relational data model, ACID transaction properties, database integrity constraints, and NIST SP 800-34 Rev. 1 (Contingency Planning Guide for Federal Information Systems) Sections 3.2.1, 3.4.2 and 5.1.2, Appendix E controls CP-6 and CP-9, and the Appendix G glossary.
About this topic
Every figure on a financial statement began as a value somebody put into a box on a screen. Between that box and the statement sit tables, keys, constraints, transfers, and backups. Everything here asks whether the number survived the trip.
The question this group answers. How is data structured, controlled, and preserved from the moment it is created to the moment it is destroyed, and which control reaches which defect?
Key points
- A relational database organizes data into tables with rows (records) and columns (fields) linked by keys.
- Normalization eliminates redundancy: 1NF removes repeating groups, 2NF removes partial dependencies, 3NF removes transitive dependencies.
- Referential integrity ensures that foreign key values match an existing primary key in the related table.
- The data lifecycle covers creation, storage, use, sharing, archival, and destruction.
What the lessons cover
- Data lifecycle and governance
- Relational structure and keys
- Data integrity controls
- ETL, backup, and retention
- Data classification and handling requirements
- Constraints, master data, and the defects each control reaches
- Computing recovery objectives from an outage timeline
- Choosing a backup strategy: restore sets, windows, and chain risk
- Retention schedules, legal holds, and secure destruction
- What is authoritative here, and what is convention
Authoritative references
- NIST SP 800-34 Rev. 1, Contingency Planning Guide for Federal Information Systems:
- Section 3.2.1, the business impact analysis and the identification of recovery priorities.
- Section 3.4.2, the backup methods and their selection.
- Section 5.1.2, the alternate site and recovery strategy considerations.
- Appendix E, the contingency planning controls, including CP-6 (alternate storage site, with CP-6(1) for separation from the primary site) and CP-9 (system backup).
- Appendix G, the glossary of recovery terms, including maximum tolerable downtime, recovery time objective, and recovery point objective.
- The relational data model, the ACID transaction properties, and database integrity constraints (entity, referential, and domain integrity) are stated as established database theory and convention rather than as the text of a single standard; the lesson's section on what is authoritative and what is convention draws that line.
How PocketCPA uses these sources
Every lesson is written in original words and cites the paragraph each rule comes from. No standard's text is reproduced. How lessons and questions are written and checked is set out in our methodology.