Data Classification and Ownership

Not everything needs a safe

At home, you don’t lock the TV guide in a safe, but you probably keep your passport somewhere secure. Protecting everything to the highest level would be expensive and exhausting. Protecting nothing would be reckless.

Data classification sorts information by:

sensitivity: how much harm if it’s disclosed
criticality: how much harm if it’s lost or corrupted

so that controls and costs match the risk. It also makes policies practical: rules are written once per level, not once per document.

A typical scheme

Public, internal, confidential and restricted, from least to most sensitive.

Most organisations use three to five levels, for example:

Public: approved for release
Internal: for staff; low harm if disclosed
Confidential: significant harm if disclosed; need-to-know only
Restricted / secret: severe harm; strictest controls

Government schemes use levels like confidential, secret and top secret. Too many levels confuses users; too few can’t tell data apart.

Who decides

Role	Responsibility
Data owner	A business manager who decides the classification, approves access, and reviews both periodically
Data custodian	Puts the required controls in place (IT, DBAs, storage teams)
Data user	Handles data according to its classification

The owner decides. IT and security provide the scheme and the tools, but they don’t classify on the business’s behalf.

The level drives the rules

Classification level drives access, encryption, labelling, storage, retention and disposal.

Each level has rules for:

who may approve access, and least privilege
encryption at rest and in transit
labelling of documents, emails and systems
where the data may be stored (approved cloud services, removable media)
how it may be sent (email, file transfer)
how long it’s kept
how it’s securely destroyed

Doing it in practice

Inventory, owner classifies, apply handling rules, review.

Inventory first. You can’t classify what you haven’t found. Data discovery tools find sensitive data in unexpected places.
Reclassify as value changes. Draft financial results are restricted until they’re published, then public.
Aggregation can raise sensitivity. Names alone are harmless; names plus dates of birth plus addresses are an identity thief’s dream.
Default classification: unlabelled data should default to a protective level such as internal. Otherwise it tends to get the lowest protection.

Example. An auditor finds that the HR system’s salary data is marked “internal”, the same as the canteen menu, because IT applied a single default label to every application. No business owner was ever asked. The auditor recommends owner-led classification, starting with an inventory of systems holding personal data.

How the exam asks about it

If the question asks…	The answer is usually…
First step in protecting information assets	Inventory and classify them
Who determines data classification	The data owner
Main benefit of classification	Protection proportionate to value and sensitivity
Data custodian’s role	Implement controls as directed by the owner
Data whose sensitivity changes	Periodic review and reclassification

In short

Data classification groups information by sensitivity and criticality so that protection is proportionate.
The data owner is responsible for classifying data and reviewing the classification periodically.
Classification drives access rules, encryption, labelling, storage, transmission, retention and disposal requirements.
Typical schemes have three to five levels, such as public, internal, confidential and restricted.
Too many levels makes classification hard to apply; too few doesn't differentiate protection.
Inventory first, then classify: you can't classify what you haven't identified.

Exam traps

The first step in protecting information is identifying and classifying it.
IT or security doesn't decide classification; the business owner does.
Classification must be reviewed as data's value changes (for example, results become public after announcement).
Unlabelled data is often handled at the lowest level of protection.
Aggregation can raise sensitivity: individually harmless data can be sensitive together.

Slides

Click the slide and use the arrow keys. F toggles full screen.