What is a Data Classification Policy?

by Chris Brook on Tuesday December 4, 2018

Learn about data classification policies, benefits, examples, and best practices, in this week's Data Protection 101, our series on the fundamentals of information security.

Data classification helps us to categorize data in a way that conveys the sensitivity of information, such as data that must be safeguarded for confidentiality, integrity, and availability. Here’s what you need to know about the importance of data classification policies, how they work, and best practices for policy development.

Definition of a Data Classification Policy

A data classification policy is primarily concerned with the management of information to ensure that sensitive information is handled well with respect to the threat it poses to an organization. It also factors in how this gathered data is being used and structured within an organization to allow authorized personnel to get the right pieces of information at the right time, while aiding in ensuring that only those who are authorized are able to view or access information. The database of any organization contains data which differs in its level of sensitivity, i.e., some data are more sensitive than others.
Data classification, security policy, and risk analysis are related functions that organizations use in conjunction to enhance security:

A data classification policy is the personification of an organization’s tolerance for risk.
A security policy is a high-level plan stating the management intent corresponding to how security is supposed to be proficient in an organization, what actions are acceptable, and the magnitude of risk the organization is prepared to accept. For instance, a data security policy could perform a risk assessment or could have the organization’s data classified.
Risk analysis balances an organization’s assets against threats of loss and is the catalyst to implementing safeguards or countermeasures that mitigates risk.

Therefore, data classification policies and risk analysis are separate concepts that fall under the security policy umbrella.

How Data Classification Policies Work

A data classification policy maps out a variety of components in an organization. It then considers every type of data belonging to the organization and subsequently classifies the data according to storage and permission rights. These data may perhaps be categorized as sensitive, public, confidential, or personal. A data classification policy should also take into consideration any specific data classification levels or categories adopted by industry regulations or standards. Data classification policies enable organizations to apply the appropriate level of security to data, lowering the company’s overall risk.

Blog Post

Getting Started with Data Classification

READ NOW

Benefits of Data Classification Policies

Companies benefit in several ways from developing a data classification policy, including:

Data classification policies help an organization to understand what data may be used, its availability, where it’s located, what access, integrity, and security levels are required, and whether or not the current handling and processing implementations comply with current laws and regulations.
It is the most effective and efficient system for protecting data as it helps to categorize data to protect critical, sensitive, and classified information. If sensitive data get into the wrong hands, organizations may be liable for penalties for violating laws and regulations and they may suffer from financial loss or reputation damage.
Data classification policies help organizations meet regulatory compliance as well as industry best practices and customer expectations.
It also helps in optimizing designated security funds by allowing organizations to determine what security measures to invest in based on the amount of sensitive data that requires protection, where it’s located, and the threat landscape.

Examples of Data Classification Policies

Example 1:

Program: Criminal Records
Information System: Public Safety Policing Services
Information types:

Criminal apprehension records: Information regarding arrest warrants.
Criminal investigation and services: Data related to current investigations and summary information on past investigations.

Information type	Data Classification	Confidentiality Impact	Integrity Impact	Availability Impact
Criminal Apprehension records	Public	LOW	MID	MID
Criminal Investigation and services	Confidential	HIGH	MID	MID

Example 2:

Program: State Hospitals
Information system: Hospital Administration System
Information types:

Health Care Delivery Services: Completes medical records for all former and current medical records.
Health Care Administration: Provides billing and accounting services in support of hospital activities.
Inventory Control: Tracks all tangible hospital assets from acquisition to disposal.

Information type	Data Classification	Confidentiality Impact	Integrity Impact	Availability Impact
Health Care Delivery Services	Confidential	HIGH	HIGH	HIGH
Health Care Administration	Confidential	HIGH	MID	MID
Inventory Control	Confidential	HIGH	MID	MID

Best Practices for Developing a Data Classification Policy

Some of the best practices for developing a data classification policy include:

1. Leveraging automated tools that can aid in streamlining the data classification process, automatically analyzing and categorizing data based on pre-determined parameters.
2. Identifying the responsible program area, business characterization, and needs. To understand the business characterization and needs, key questions to be asked include:

Which program collected the information?
Where is the information contained?
Which program is liable for facts integrity and accuracy check?
Which program budgets the expenses incurred in collecting, processing, storing and distributing the information?
Which program has learned the most about the useful value of the information?3. Establishing a Program Area Designee(s) whose role is to manage records within the organization.

4. Conducting regulatory and legal assessment. A thorough job must be done to know which law or regulation is applicable to the organization; it is important and should not be overlooked as many security and privacy laws today have monetary penalties associated with non-compliance.

For today’s enterprises, a data classification policy serves as the foundation of effective security measures. Without a consistent system for classifying data, it’s impossible to adequately protect sensitive data – after all, you can’t protect it if you don’t know it exists, where it’s located, or whether it requires protection at all.

Tags: Data Protection 101

Chris Brook

Chris Brook is the editor of Digital Guardian’s Data Insider blog. He is a cybersecurity writer with nearly 15 years of experience reporting and writing about information security, attending infosec conferences like Black Hat and RSA, and interviewing hackers and security researchers. Prior to joining Digital Guardian–acquired by Fortra in 2021–he helped launch Threatpost, an independent news site that was a leading source of information about IT and business security for hundreds of thousands of professionals worldwide.