When should organisations use query history and popularity scores to make data governance decisions?

Using Usage Signals to Prioritise Data Governance Work

Query history and popularity scores are most useful when governance teams need a practical proxy for actual data value, not as a substitute for ownership, sensitivity, or regulatory review. They help answer a different question from classification: which datasets are genuinely used, which are candidates for certification, and which are absorbing maintenance effort without much business demand. That makes them valuable for triage, roadmap planning, and stewardship prioritisation.

For organisations managing large catalogues, these signals reduce dependence on anecdote and help surface where data products are pulling real demand. They are especially helpful when teams need to justify investment in quality, documentation, or service levels for high-traffic assets. They are less useful when a dataset is strategically important but rarely queried, because low usage does not mean low significance. Governance decisions still need to account for sensitivity, criticality, legal hold, and retention obligations, even when usage is sparse. Query history and popularity scores are best treated as decision support, not decision authority. In practice, many data teams discover the mismatch between popularity and importance only after they have already de-prioritised an underused but mission-critical dataset.

Organisations that use these signals well usually combine them with stewardship review, business context, and classification so that usage informs the decision without overruling it. The NIST Cybersecurity Framework 2.0 can help teams keep that broader governance lens in view when usage data needs to sit alongside risk, resilience, and accountability.

How Query History Changes the Governance Workflow

In practice, query history and popularity scores work best as ranking inputs. They can help teams decide which datasets should be certified first, where to invest in documentation, and which tables or reports should move into active support. A high score usually indicates repeated reliance, broader dependency, or a stronger case for data quality improvements. A low score can indicate limited business value, but it can also reflect poor discoverability, naming problems, or access restrictions that suppress usage rather than reveal irrelevance.

The key governance mistake is to treat these signals as a complete measure of value. Query logs capture observed behaviour, not latent need. A dataset may appear unpopular because it is hard to find, because only a small group should access it, or because its value is episodic rather than continuous. That means the right interpretation depends on whether the dataset is a shared analytical asset, a controlled reference set, or a regulated record. Query history is strongest where consumption itself is a meaningful indicator of operational importance.

• Use query frequency to prioritise stewardship work where many users depend on the same data.
• Use popularity scores to identify candidates for certification, quality uplift, or better documentation.
• Use sustained inactivity as a prompt for review, not automatic deletion or archival.
• Check whether low usage reflects true lack of value or simply poor discoverability.

Teams should also preserve the logic behind these decisions, because popularity can shift quickly when a new use case, product, or reporting obligation appears. NIST SP 800-53 Rev 5 Security and Privacy Controls is useful here because it reinforces the need for controlled management of information assets, evidence, and access decisions rather than ad hoc cleanup. Where query data is incomplete, biased by tooling, or unavailable across platforms, this guidance breaks down and governance must rely more heavily on business owners and formal classification.

When Popularity Helps, and When It Should Not Decide Alone

Tighter data prioritisation often improves stewardship efficiency, but it also increases the risk of overlooking low-volume assets that still carry high compliance or operational significance, so organisations must balance convenience against materiality.

The main edge case is the dataset that matters precisely because it is rarely touched. Examples include legal, audit, finance, security, and regulatory records, where usage frequency is a weak proxy for importance. Another edge case is short-lived but highly consequential data, such as incident-response records or data used only during quarter-end processes. In those cases, popularity can mislead governance teams into underinvesting in control, retention discipline, or recovery planning.

There is also a governance-versus-consensus issue. Some organisations want popularity to drive archiving decisions automatically, but that approach is not broadly accepted as safe for regulated or operationally critical datasets. The more defensible pattern is to use popularity to trigger review, then apply classification, stewardship judgment, and retention policy before acting. This is where the distinction between “used often” and “important” must stay explicit.

Where query history is fragmented across tools, or where a platform only sees part of the consumption pattern, popularity scores can create false confidence. In those environments, the score should be treated as directional rather than authoritative. Organisations should reserve automatic action for low-risk, well-understood datasets and require human review for anything sensitive, regulated, or business-critical. Practitioner takeaway: usage signals are strongest as a prioritisation aid, not as a stand-alone governance rule, and the highest-value judgment is knowing when low usage is actually a warning sign rather than a reason to downgrade the asset.

Related resources from NHI Mgmt Group

• How should organisations use field-level attribute provenance to make identity decisions without overtrusting shared data?
• How should organisations structure data governance so AI agents can make reliable decisions in enterprise environments?
• Why is it important to integrate identity and data governance?
• How should security teams use IAST and RASP in NHI governance?