A Data Flow Map, sets out where Risk Factor data can be drawn from.
For each Risk Factor, the map will show
if a source for the data is known the Source Organisation which controls the data the Information Type from which the Risk Factor can be derived if data sharing/reuse has been agreed in principle for the new Vulnerability Purpose if data is accessible in practice The SAVVI Concept Model defines ‘Information Type’ as
Examples of Information Type might be
This approach
avoids introducing the names of local computer systems allows the original Purpose of the data collection to be recorded The SAVVI Concept Model defines ‘Data Product’ as
At best, the Source Organisation will have designed a Data Product to meet the requirements of the Lead Organisation, and so they will have applied a transformation from an operational dataset, into a smaller set of ATTRIBUTES.
However, it is also likely that a Source Organisation will just provide a cut of their data so that the Lead Organisation has to apply a transformation so that it can be used by the Risk Policy. Either way, SAVVI calls this a Data Product, in line with the theory of a . Steps