SECURITYATLAS✳

✳ The reference desk / In practice

Data classification

Labeling records by the harm of disclosure, alteration, or loss so protection and retention can follow.

What it means

Classification turns an assessment of data sensitivity and business importance into handling rules. Labels such as public, internal, and confidential are useful only when people understand what each means for access, sharing, storage, retention, and disposal. The scheme should consider harm from alteration or loss as well as disclosure: a public safety schedule may not be secret but still need strong integrity protection. Data owners help make these decisions because they understand its purpose and consequences. Labels should follow copies and exports where the supporting systems allow it.

The idea at a glance / Data

A label needs an implemented handling rule.

Compare two confidential copies with the same data and different service-side access controls.

Synthetic Chronos Hub HR owner Sloane Sterling labels R101 Confidential under local scheme H101 because it contains a home address and clearance flag. H101 permits Kael’s staffing role and refuses the outside reader. Copy X101 has that rule configured; Y101 carries only the label. Both preserve the same row.

Data classification: Compare two confidential copies with the same data and different service-side access controls. The explanation below describes the relationships.Chronos Hub HR · owner’s scheme H101Same sensitive row; two labeled copiesOwner’s classification of R101Confidential · address + clearanceOwner identifies disclosure harmRequired handlingStaffing role read · outside deniedRetention date not configuredTwo copies keep the same labelX101: rule · Y101: label onlyBoth keep the original sensitive rowIndependent copy readsX101: Kael 200 · outside 403Y101: outside 200 · rule missingSAME LABEL · DIFFERENT READS

READ THE PICTURE

Compare label and handling

X101 and Y101 carry the same Confidential label. X101 refuses the outside read; label-only Y101 returns the sensitive row. The label has not enforced the rule.

Keep in mindConfidential is an illustrative local category, not a government classification or legal determination. Label binding is assumed; the selected access checks do not establish encryption, complete copy coverage, retention or disposal. H101’s retention date remains unconfigured. Public information can still need integrity and availability protection.

Read the complete example
  1. Compare label and handling. X101 and Y101 carry the same Confidential label. X101 refuses the outside read; label-only Y101 returns the sensitive row. The label has not enforced the rule. Both copies retain R101’s synthetic driver, homeAddress and clearance fields. Sloane’s local classification maps disclosure harm to a staffing-only read requirement. The service-side rule on X101 returns HTTP 200 to Kael and a bodyless 403 to the outside reader. The separate Y101 fixture has no read restriction and returns HTTP 200 with the same row to that reader. Its label is unchanged. This is a deliberately incomplete copy configuration, not a claim that every labeled document leaks or every label is merely decorative. Systems can use trusted labels as policy inputs when enforcement is actually configured. H101’s retention date remains unconfigured, so passing the selected X101 access tests does not complete the handling plan. The original and both copies remain for comparison.

Confidential is an illustrative local category, not a government classification or legal determination. Label binding is assumed; the selected access checks do not establish encryption, complete copy coverage, retention or disposal. H101’s retention date remains unconfigured. Public information can still need integrity and availability protection.

Diagram references: CIS Control 3: Data Protection · NIST SP 800-53 Rev. 5: processing purposes and security attributes

AN ILLUSTRATIVE SCENARIO

Two confidential copies, different enforcement

Fictional owner Sloane classifies roster R101 under local scheme H101 and requires staffing-only reads. Copies X101 and Y101 retain the same Confidential label and sensitive row. X101 has a configured service-side access rule: Vera reads successfully while the outside reader is refused. Y101 has only the label and returns the row to that reader. The selected tests expose an enforcement gap; retention remains unconfigured.

Put it to work

  1. Create a small, understandable set of categories with data-owner input. Define the potential harm each category represents and give recognizable examples from the organization's actual work.
  2. Connect each category to concrete handling requirements, including permitted recipients, access, storage, sharing, retention, and disposal. Make the approved way to perform common tasks practical for staff.
  3. Apply labels to important datasets, verify how exports inherit them, and review classifications as use changes. Give staff a route to resolve uncertainty or challenge an incorrect label.

How to check your work

Select one dataset and follow it through creation, sharing, export, and deletion. Ask its owner and a typical user to explain the handling rule, then check that the configured permissions and retention actually match that rule.

Connect the ideas

  • DLP

    Controls that detect or block sensitive data leaving a channel such as email, web, or endpoint.

  • Confidentiality

    The property that information is available only to people or systems authorized to see it.

  • Integrity

    The property that data and processes remain complete and unaltered except by authorized action.

  • Data minimization

    Collecting, using, and keeping only the personal information a stated purpose needs, and no longer than that purpose requires.

Explore a field lesson

Find your next idea.

Tip: press / to open search. Escape closes this window.