Does your organization maintain a tracking system that records the provenance, data owner, and geolocation for all designated sensitive data types?

This question assesses whether your organization has implemented data tracking mechanisms that maintain visibility of where sensitive data originated from, who is responsible for it, and where it is physically or virtually stored. Such tracking is essential for data governance, regulatory compliance (like GDPR or CCPA), and enables proper incident response when data breaches occur. Evidence of fulfillment could include a data inventory or catalog system that shows metadata fields for each data asset including origin/source information, assigned data owner/steward, and current storage location details. Screenshots of this system, a sample data tracking report, or documentation of your data classification and tracking procedures would serve as appropriate evidence.