Include an axis denoting the relative sensitivity of data (steps in the activity highlighted below). This adds time to the activity, but can help reinforce risk management as a theme during your training.
In an ideal scenario, the participants have a high level of trust with each other and will be comfortable speaking freely. In situations in which participants are unfamiliar to one another, trainers may want to try to break a larger group up into teams or small groups that share similar situations.
Explain to participants that this session will cover an information mapping activity, the purpose of which is to get a sense of what and where our important information and data actually is. Start by listing the different places where our information is stored, according to participants.
Add these titles to the sheet or whiteboard and construct the matrix (see the figure above) around them if you have not already done so.
As a next step, begin to elicit from participants what types of information or data they have in each of the above places. Some examples might include (again, these are useful to kick-off with if no suggestions are forthcoming):
To encourage participant interaction, write one of the above examples on a post-it note and affix it to the appropriate box within the matrix; then, ask whether there is another copy of this data in another storage medium or location. If there is, you can use another sticky (preferably of a different color) and affix it within the appropriate box for where the duplicate is kept. You can use this moment to teach the difference between master copies and duplicates.
Repeat this process with another example, hopefully provided by a participant.
If including the sensitive / non-sensitive axis, refer back the two examples and introduce the axis representing sensitivity. The higher on the chart, the more sensitive the data - place the two stickies on this axis, in locations representing their relative sensitivity.
For this step, now divide the group into smaller teams - it helps if there are relatively clear thematic distinctions within the group, such as nationality, type of work, supported community, etc. Have a large sheet of paper with an unfilled matrix ready for each group.
Each group will be given two sets of post-it notes, each set a different color, and each participant should think of the 5 most important types of data they work with. They should write one type per note.
For any type of data that has a duplicate location, they should represent this with a different colored post-it note. For instance, if the two post-it colors are Yellow and Pink, have all master versions of the data be Yellow and any duplicates of that master be Pink.
When each participant in a team has their top 5 most important data types created, they should go to the team’s matrix and affix their completed post-it notes within the relevant boxes.
Give participants 5-10 minutes to work on identifying their types of data. Once the time is up, there should be one completed matrix per team.
It might be useful to go from team to team, identifying interesting characteristics of each matrix. For example, note where there is particularly heavy dependence on one device, or where there’s a lack of duplicate stickies, etc.
Explain that this exercise helps to give us a useful, visual sense of where our data is stored.
It demonstrates only a small percentage of the data we all generate each day, whether we are aware of it or not. Referring to one of the teams’ matrices, for example, mention the information that is shown as kept on their computer hard drive - this will usually be the fullest part of many matrices produced during this exercise, otherwise mention whichever storage location appears to have the most data stored on it.
So what can we do to avoid this? We should put more copies into different locations - this is called backing up.
The sensitive / non-sensitive distinction in the matrix is optional, and should only be done with enough time to drive adequate discussion about the relative sensitivity of information. It can also be presented as a scale rather than a dichotomy.