What are the five 5 classification levels of information?

Data classification is a vital component of any information security and compliance program, especially if your organization stores large volumes of data. It provides a solid foundation for your data security strategy by helping you understand where you store sensitive and regulated data, both on premises and in the cloud. Moreover, data classification improves user productivity and decision-making, and reduces storage and maintenance costs by enabling you to eliminate unneeded data.

In this article you will learn what benefits data classification offers, how to implement it and how to choose the right software solution.

Key Data Classification Terms and Definitions

Data classification is the process of organizing structured and unstructured data into defined categories that represent different types of data. Standard classifications used in data categorization include:

• Public
• Confidential
• Sensitive
• Personal

Sensitive data is a general term representing data restricted to use by specific people or groups. Sensitive and confidential data are often used interchangeably. Examples of sensitive data include intellectual property and trade secrets.

Data reclassification is re-categorization of data to apply appropriate updates, for example, based on changes to legal or contractual obligations, data usage or value, or new or revised regulatory mandates.

Data tagging or labeling adds metadata to files indicating the classification results.

Purpose of Data Classification

Data classification helps you understand what types of data you store and where that data is located. This intelligence:

• Informs risk management, legal discovery and regulatory compliance processes
• Helps prioritize security measures
• Improves user productivity and decision-making by streamlining search and e-discovery
• Reduces data maintenance and storage costs by identifying duplicate and stale data
• Helps IT teams justify requests for investments in data security.

Benefits of Data Classification

More broadly, data classification helps organizations improve data security and ensure regulatory compliance.

Data Security

Classification is an effective way to protect your valuable data. By identifying the types of data you store and pinpointing where sensitive data resides, you are well positioned to:

• Prioritize your security measures, adjusting your security controls based on data sensitivity
• Understand who can access, modify or delete data
• Assess risks, such the business impact of a breach, ransomware attack or other threat

Regulatory Compliance

Compliance regulations require organizations to protect specific data, such as cardholder information (PCI DSS) or the personal data of EU residents (GDPR). Data classification enables you to identify the data subject to particular regulations so you can apply the required controls and pass audits.

Here’s how data classification can help you meet common compliance standards:

• GDPR — Data classification helps you uphold the rights of data subjects, including satisfying data subject access request by retrieving the set of documents with data about a given individual.
• HIPAA — Knowing where all health records are stored helps you implement security controls for proper data protection.
• ISO 27001 — Classifying information according to value and sensitivity helps you meet requirements for preventing unauthorized disclosure or modification.
• NIST SP 800-53 — Categorizing data helps federal agencies properly architect and manage their IT systems.
• PCI DSS — Data classification enables you to identify and secure consumer financial information used in payment card

Types of Data Classification

• Content-based classification inspects and interprets files to identify sensitive information.
• Context-based classification looks at application, location, creator tags and other variables as indirect indicators of sensitive information.
• User-based classification depends on manual selection of each document by a person.

Examples of Data Classification Categories

Example of a Basic Classification Scheme

The simplest scheme is three-level classification:

• Public data — Data that can be freely disclosed to the public. Examples include your company contact information and browser cookie policy.
• Internal data — Data that has low security requirements but is not meant for public disclosure, like marketing research.
• Restricted data — Highly sensitive internal data. Disclosure could negatively affect operations and put the organization at financial or legal risk. Restricted data requires the highest level of security protection.

Example of a Government Classification Scheme

Government agencies often use three levels of sensitivity but give them different labels than listed above: top secret, secret and public. For more complex data structures, more levels may be added. Here is a five-level strategy with examples:

• Top secret — Cryptologic and communications intelligence
• Secret — Select military plans
• Confidential — Data indicating the strength of ground forces
• Sensitive unclassified — Data tagged “For Official Use Only”
• Unclassified — Data that may be publicly released with authorization

Example of Commercial Classification

Typically, organizations that store and process commercial data use four levels to classify data: three confidential levels and one public level. Some expand that to a five-level system with the following levels:

• Sensitive — Intellectual property, PHI
• Confidential — Vendor contracts, employee reviews
• Private — Customer names or images
• Proprietary — Organizational processes
• Public — Information that may be disclosed to anyone

Data Classification Process

Effective Information Classification in Five Steps

1. Establish a data classification policy, including objectives, workflows, data classification scheme, data owners and handling
2. Identify the sensitive data you store.
3. Apply labels by tagging data.
4. Use results to improve security and compliance.
5. Data is dynamic, and classification is an ongoing process.

Building an Effective Data Classification Policy

A data classification policy is a document that includes a classification framework, a list of responsibilities for identifying sensitive data, and descriptions of the various data classification levels.

A good classification policy:

• Uses criteria that are straightforward and avoid ambiguity, but that are generic enough to apply to different data sets and circumstances
• Is clear and written in simple language
• Fits the organization’s business
• Is limited to 3 or 4 classification levels
• Contains a point of contact for clarification
• Establishes a review schedule

How to Select a Data Classification Solution

Look for these features:

• Compound term search — Improves accuracy by minimizing false positives and false negatives.
• Index — Enables you to identify sensitive terms without re-crawling the data.
• Flexible taxonomy manager — Makes it easy to add and modify terms and rules.
• Workflows — Automatically takes specific actions when a document is classified in a certain way. For example, a workflow might move sensitive data away from a public share.
• Breadth of coverage — Supports both cloud and on-premises data sources, including both structured and unstructured data.

FAQ

What is the purpose of data classification?  

Data classification sorts data into categories based on its value and sensitivity.

Why is data classification important? What benefits does it offer?

Data classification helps you prioritize your data protection efforts to improve data security and regulatory compliance. It also improves user productivity and decision-making, and reduces costs by enabling you to eliminate unneeded data.

What are common data classification levels? 

Data is often classified as public, confidential, sensitive or personal.

What are the data classification types? 

Classification can be content-based, context-based or user-based (manual).

What software should I use for data classification? 

Look for data classification software, like that offered by Netwrix, which:

• Uses compound word search to ensure accurate classification that minimizes false positives
• Has an index so you can find sensitive terms without re-crawling your data stores
• Includes a flexible taxonomy manager that empowers you to customize your classification parameters
• Provides workflows to automate processes such as migrating sensitive data from public shares
• Supports both on-premises and cloud content sources, including both structured, and unstructured data

Who is responsible for data classification in an organization? 

Organizations typically designate a Security and Risk Manager, a Data Protection Manager, Compliance Committee or a similar entity.