The request looked harmless, and it turned a quiet repair shop into a textbook DataSecOps case. A customer was selling his light sport aircraft, the buyer’s insurer wanted the maintenance history, and Ray \u2014 who runs a two-bay repair shop in the high desert, and who is fictional but could land in any hangar you know \u2014 went looking for the file. He found it, eventually, in a folder called FINAL_final. What he could not produce was the second thing the insurer asked: a record of who had opened or changed those documents along the way. Four people had held the shop’s shared login that year. Two had moved on. One had, in Ray’s words, “gone to be a boat mechanic.” The insurer approved the claim anyway, and Ray spent the weekend staring at his own shop the way a mechanic stares at an engine that has been running rough for years.<\/p>\n
Write the symptoms down and they look familiar to anyone who has run a small operation:<\/p>\n
Individually, each item feels like small-business weather \u2014 annoying, survivable, tomorrow’s problem. Together they are a diagnosis waiting for a patient, and Ray’s weekend made him the volunteer. Each symptom also hides a bill: the shared login means any incident implicates everyone; the unowned folders mean every request starts from zero; the undated helpers mean old access keeps working quietly after the handshake; and the unwatched exports mean the shop learns about leaks from other people.<\/p>\n
The mistake would be treating five separate problems. It is one problem wearing five hats: nobody ever wrote down what the shop holds, who may touch it, and until when. The discipline built around exactly that mistake is young \u2014 the name DataSecOps came from Ben Herzberg at Satori Cyber, writing in August 2021, and it stays a vendor’s coinage rather than an official standard; data security governance is the older, Formal name for the same trade. What earned Ray’s respect was the scope’s modesty, laid out in the DataSecOps write-up on the Ops Atlas<\/a>: decisions attach to small, concrete things \u2014 a record, a field, a single lookup \u2014 because small operations protect things one field at a time, not one server room at a time. His five symptoms, read properly, are five missing pieces of one habit. The habit, in the discipline’s own verbs: count what you hold, name its owners, put dates on access, watch the exits, prune on a schedule. Five verbs, repeated forever, at whatever scale the shop happens to be. Nothing in the list needs new software; the reference is explicit that the loop comes first and tools follow it.<\/p>\n The fix followed the discipline’s loop, translated into shop language:<\/p>\n Requests for new access now follow the same shape as everything else in the shop: state what you need, why, and until when, and the owner approves it before the system does.<\/p>\n Ray expected the inventory to be dull. It was not. Fourteen people had known the shared login over the years, including a part-time bookkeeper whose last day had been eighteen months earlier. The export emails \u2014 the ones mentioned in symptom four \u2014 had been going to a vendor address nobody had contacted since a product recall two summers before. Nothing malicious surfaced, which Ray now understands is the usual outcome and the worst argument for waiting: the absence of disaster so far is not evidence of safety, only of luck with a longer memory than any of us. The quieter finds bothered him more. Nobody had a complete backup of the FINAL_final folder before 2023, and the paper logs had never been photographed at all. The insurer had asked a reasonable question; the shop had been one hard-drive failure away from having no answer of any kind.<\/p>\n The quarterly prune keeps the plan alive, and Ray has learned to judge it by one output only: did anything get removed? A review that deletes nothing is a meeting wearing a costume, and the discipline says so plainly \u2014 revocation is the product, minutes are the by-product. His harshest critic was himself, when the first prune retired his own standing access to the parts database he had not opened since spring. That is the system working. Aviation taught him this decades ago with the fuel-system mistakes pilots should avoid<\/a>, reinforced by the maintenance checklist he swears by<\/a> and the landing-gear checklist<\/a> that grounds half his service visits: small checks, done on schedule, prevent the expensive day. Records needed the same medicine, not because Ray runs a careless shop \u2014 he does not \u2014 but because careful people assume care scales on its own. It does not. Write it down, name an owner, set a date. Then go back to the aeroplanes, which is the whole point of having a shop. The insurer packets now go out with a cover note and a log entry, and Ray reports \u2014 with visible relief \u2014 that nobody has called the shop boring once since. Boring files, interesting aeroplanes: a trade he would recommend to any owner who asks.<\/p>\n","protected":false},"excerpt":{"rendered":" A repair shop, an insurer’s question it could not answer, and a five-step DataSecOps plan: inventory, owners, expiring access, exit watch, quarterly prune.<\/p>\n","protected":false},"author":6,"featured_media":950,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[607],"tags":[],"class_list":["post-949","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-light-sport-aircraft"],"_links":{"self":[{"href":"https:\/\/lightsportwest.com\/blog\/wp-json\/wp\/v2\/posts\/949","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lightsportwest.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lightsportwest.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lightsportwest.com\/blog\/wp-json\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"https:\/\/lightsportwest.com\/blog\/wp-json\/wp\/v2\/comments?post=949"}],"version-history":[{"count":1,"href":"https:\/\/lightsportwest.com\/blog\/wp-json\/wp\/v2\/posts\/949\/revisions"}],"predecessor-version":[{"id":962,"href":"https:\/\/lightsportwest.com\/blog\/wp-json\/wp\/v2\/posts\/949\/revisions\/962"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/lightsportwest.com\/blog\/wp-json\/wp\/v2\/media\/950"}],"wp:attachment":[{"href":"https:\/\/lightsportwest.com\/blog\/wp-json\/wp\/v2\/media?parent=949"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lightsportwest.com\/blog\/wp-json\/wp\/v2\/categories?post=949"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lightsportwest.com\/blog\/wp-json\/wp\/v2\/tags?post=949"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}The DataSecOps treatment plan<\/h2>\n
\n
What the first week turned up<\/h2>\n
The follow-up checkups<\/h2>\n