Notifications
Clear all
Topic starter
22/07/2026 4:37 pm
TL;DR: Data governance defines who can access data, under what conditions, and with what accountability, while data management keeps storage, pipelines, and delivery working. Apono’s article argues that the distinction becomes more consequential as NHIs expand access, and cites GitGuardian’s 2025 report showing 23.77 million new secrets leaked on GitHub in 2024, a 25% year-over-year increase. Once access is automated, governance without enforcement becomes paperwork.
NHIMG editorial — based on content published by Apono: Data Governance vs Data Management: 7 Differentiating Factors
By the numbers:
- 23.77 million new secrets leaked on GitHub in 2024, a 25% year-over-year increase.
Questions worth separating out
Q: How should teams govern data access when service accounts and pipelines hold the permissions?
A: They should govern the identity that actually reaches the data, not just the human who requested it.
Q: Why do data governance programmes break when secrets are long-lived?
A: Long-lived secrets turn access into a reusable capability rather than a task-scoped entitlement.
Q: What do security and governance teams get wrong about data quality?
A: They often treat data quality as a data operations issue rather than a control dependency.
Practitioner guidance
- Map data access to the real identity executor Inventory which service accounts, pipelines, applications, and tokens actually access sensitive data, then tie each one to a named owner and a lifecycle process.
- Replace standing access with task-scoped access Scope data access to the minimum dataset and the minimum time window required, then revoke it automatically when the task or pipeline run ends.
- Treat secrets rotation as a governance control Classify long-lived credentials as a governance risk, not just a hygiene issue, and prioritise rotation for identities that can reach databases or analytics platforms.
What's in the full article
Apono's full article covers the operational detail this post intentionally leaves for the source:
- A detailed comparison table that maps governance responsibilities to data management responsibilities for implementation teams.
- Specific examples of how access policy, auditability, and lifecycle management apply across cloud data environments.
- The article's practical framing for translating governance intent into time-bound access controls and routine enforcement.
- The source's explanation of where Apono positions itself in the enforcement layer between governance and management.
👉 Read Apono's analysis of data governance vs data management →
Data governance vs data management: where identity controls break down?
Explore further
24/07/2026 4:13 pm
Governance and management fail in different ways, but NHI exposure is where the boundary breaks down. Data governance is meant to define who may access data and under what conditions, while data management keeps the environment usable. Once the actual executor is a service account, pipeline, or application token, the policy is only as strong as the lifecycle of that identity. Practitioners should treat data access as an identity control problem, not a documentation problem.
A few things that frame the scale:
- 23.77 million new secrets leaked on GitHub in 2024, a 25% year-over-year increase, according to Guide to the Secret Sprawl Challenge.
- Our research also shows that 52 NHI breach cases remain a useful reference set for understanding how exposed credentials translate into real-world identity compromise.
A question worth separating out:
Q: Who is accountable when a compromised NHI exposes data?
A: Accountability sits with the team that created, approved and operates the identity, not with the platform alone. NHI incidents often happen because ownership is diffuse across development, infrastructure and security. Governance frameworks should make ownership explicit, tie entitlements to business purpose and require revocation when that purpose ends.
👉 Read our full editorial: Data governance vs data management in NHI-driven environments
