Accountability should sit with the business and identity governance owners together, because protection depends on both data ownership and access control. Security teams need clear assignment for classification, access approval, review cadence, and remediation. If those responsibilities are unclear, unstructured data ends up in a blind spot where no one can confidently explain who should grant, monitor, or revoke access.
Why This Matters for Security Teams
Unstructured data in SaaS applications is often governed as a storage problem, when the real risk is an identity and responsibility problem. Files, messages, exports, and attachments are created, shared, and copied faster than most ownership models can track them. That leaves security teams trying to protect data without a clear decision-maker for classification, approval, review, or revocation. NIST Cybersecurity Framework 2.0 treats governance as a core function, not an afterthought, which fits this problem well. NIST Cybersecurity Framework 2.0 In practice, many organisations discover that the absence of ownership is itself the control failure, especially after sensitive content has already been overshared or synchronised into downstream apps. NHIMG research shows how often identity-driven exposure becomes a breach pattern, as seen in the Snowflake breach and the Salesloft OAuth token breach, where access pathways and responsibility gaps amplified impact. NHI Mgmt Group’s research also notes that only 5.7% of organisations have full visibility into their service accounts, a useful warning sign for broader identity blind spots. In practice, many security teams encounter accountability gaps only after a data exposure has already forced a retrospective ownership hunt, rather than through intentional governance design.
How It Works in Practice
Effective accountability starts by separating three questions that are too often merged: who owns the data, who owns the SaaS application, and who owns the identity controls that mediate access. Business owners should decide whether the content is sensitive, how long it should live, and who may use it. Identity governance owners should enforce access rules, review cadence, and remediation. Security teams should coordinate the control framework and escalation path, not become the default owner for every file shared in SaaS. NIST SP 800-53 Rev 5 Security and Privacy Controls
A practical operating model usually includes:
- Named data owners for each SaaS domain or workspace, with authority to classify content.
- Identity governance owners responsible for approval workflows, recertification, and offboarding.
- Central logging and alerting for external sharing, public links, mass downloads, and token-based access.
- Documented exception handling for collaboration use cases where business need outweighs default restrictions.
This model works best when ownership is explicit in policy and reflected in the SaaS control plane. It also benefits from evidence-driven prioritisation, because NHI-related exposure is rarely theoretical. NHIMG’s Ultimate Guide to NHIs — Key Research and Survey Results highlights that 79% of organisations have experienced secrets leaks, with 77% resulting in tangible damage, showing how quickly weak accountability becomes operational loss. When unstructured data is linked to service accounts, integrations, or automations, revocation and review must include those non-human paths as well as human users. These controls tend to break down when a SaaS tenant is shared across multiple business units because no single owner can authorise remediation without slowing work across the entire environment.
Common Variations and Edge Cases
Tighter ownership often increases operational overhead, requiring organisations to balance faster collaboration against stricter review and revocation discipline. That tradeoff becomes most visible in shared workspaces, M&A environments, and SaaS platforms with weak native data governance controls. Best practice is evolving here, and there is no universal standard for whether the business owner, the application owner, or the data steward should be the final approver in every case. What matters is that one role is accountable and the others are clearly supporting that role.
Edge cases usually appear when unstructured data is automatically copied into chat tools, ticketing systems, or analytics exports. Those copies may fall outside the original SaaS owner’s control, so the accountability model must extend to downstream systems and integrations. Secrets and tokens used by bots or connectors can also bypass ordinary human review, which is why incident response should include identity revocation across both users and NHIs. NHIMG’s guidance on the BeyondTrust API key breach reinforces that access paths matter as much as file locations. Current guidance suggests treating unstructured data governance as a shared control plane, but assigning a single accountable owner per dataset, workspace, or application boundary remains the most reliable operating model.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and CSA MAESTRO address the attack and risk surface, while NIST CSF 2.0, NIST SP 800-63 and NIST AI RMF set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | GV.RM-01 | Governance requires clear accountability for risk decisions around SaaS data. |
| NIST SP 800-63 | Identity assurance underpins who can be trusted to access unstructured SaaS data. | |
| OWASP Non-Human Identity Top 10 | NHI-01 | SaaS integrations often rely on NHIs that can expose unstructured data. |
| CSA MAESTRO | Agentic and automated workflows can move unstructured data without human oversight. | |
| NIST AI RMF | AI systems handling SaaS content need governance for accountability and misuse. |
Define ownership and policy checks for automated SaaS workflows before they can read or share content.
Related resources from NHI Mgmt Group
- What is the difference between protecting applications and protecting access?
- Who is accountable when a SaaS supply chain attack exposes customer data through connected applications?
- Who is accountable for secure authorization when AI agents and MCP servers start accessing enterprise data?
- What breaks when organisations rely on opaque business applications for access control and data protection?
