Data-in-use governance

What Data-in-Use Governance Means

Data-in-use governance is about controlling sensitive information while people and systems actively work with it, not only when it is stored or sent. It governs the point where context, policy, and visibility are most likely to be lost.

Why Data-in-Use Is a Distinct Control Problem

Data at rest and data in transit are usually protected by clear technical boundaries, but data in use is handled inside live workflows where copying, pasting, summarising, and sharing can bypass those boundaries. That makes the control problem more dynamic: the question is not just whether data is encrypted, but whether policy still follows the data when it is opened in a document, chat thread, browser session, or AI prompt.

In practice, data-in-use governance sits at the intersection of classification, access intent, and user behaviour. A file that is allowed in one workspace may become risky once its contents are moved into a messaging channel, a shared note, or an AI assistant context window. The governance objective is to preserve appropriate handling rules as the data is transformed, copied, or re-expressed in another tool.

Where Policy Breaks Down During Active Use

The hardest part of data-in-use governance is that policy enforcement often weakens when data is no longer contained in the original system of record. Collaboration tools, messaging platforms, and AI workflows can strip away labels, audit context, or ownership metadata, which makes it harder to know whether a person is allowed to copy, disclose, or repurpose the information.

This is also where ambiguity appears. A user may be authorized to view a record, but not to export it into a broader audience, paste it into an external service, or use it as input to a model that persists prompts. Effective governance distinguishes between permitted access and permitted reuse, especially when workflows encourage rapid re-sharing.

How Data-in-Use Governance Supports Safer Working Tools

Good governance for data in use is designed to keep sensitive content understandable to controls even after it leaves the original application. That usually means pairing policy with the working environment so that labels, restrictions, and monitoring remain meaningful across documents, chats, tickets, and AI-assisted tasks. NIST Privacy Framework is useful here because it treats governance, classification, and privacy risk as ongoing operational concerns rather than one-time settings.

It also helps to treat data-in-use governance as part of a broader access and control model, not as a standalone policy layer. NIST SP 800-53 Rev 5 Security and Privacy Controls supports this view through controls for access control, auditing, and configuration management, while NIST Cybersecurity Framework 2.0 provides the broader govern and protect lens that helps organizations make these controls operational.

Governance Implications for Collaboration and AI Workflows

Data-in-use governance becomes especially important in collaboration and AI workflows because the same content may be copied, summarised, transformed, and redistributed in seconds. Once data is embedded into prompts, chat history, shared notes, or generated output, the original access rules may no longer be obvious to the next person who sees it. NIST AI 600-1 GenAI Profile is relevant because it frames generative AI governance around risk, provenance, and controlled use of content inside AI-enabled workflows.

The governance implication is that organisations need a clear decision about what counts as acceptable handling at the moment of use, not only at the moment of storage. If the working environment does not preserve context, the result is usually either over-sharing or under-sharing, both of which create operational friction and security exposure. The more collaborative and automated the workflow becomes, the more important it is to keep policy visible where the data is actually being handled.

NIST Privacy Framework, NIST SP 800-53 Rev 5 Security and Privacy Controls, and NIST Cybersecurity Framework 2.0 together show why this term belongs in governance, privacy, and operational security conversations at the same time.

Related resources from NHI Mgmt Group

• How should security teams use DSPM to improve data governance?
• How can teams use AI-assisted activity data without overcomplicating governance?
• How should security teams use IT asset data in identity governance?
• How should security teams use sensitive data discovery results in access governance?