data management & 3 lines of defense