Topics in this domain
- The Security Program: Charter, Scope and Objectives
- Security Team Structure, Roles and Staffing
- Working with Legal, HR, IT, Audit and the Business
- Program Implementation: From Plan to Operating Controls
- Information Asset Identification and Valuation
- Data Classification: Owners, Custodians and Users
- Data Lifecycle: Retention, Archiving and Secure Disposal
- Enterprise Architecture for Security Managers
- Information Security Architecture: Principles and SABSA
- Defence in Depth and Zero Trust
- Cloud Security and Shared Responsibility
- Control Frameworks: NIST SP 800-53, CIS Controls and ISO 27002
- Security Policy Development and Lifecycle
- Security Standards and Baseline Requirements
- Procedures, Guidelines and Acceptable Use
- Policy Enforcement, Exceptions and Review
- Designing Security Metrics: KPIs, KRIs and KCIs
- Collecting, Analysing and Reporting Metrics
- Security Maturity Models and Program Assessment
- Control Types and Categories
- Control Design and Selection Based on Risk and Cost
- Control Testing: Design vs Operating Effectiveness
- Identity and Access Management
- Network and Endpoint Security Controls
- Application Security and the Secure SDLC
- Configuration, Change and Patch Management
- Cryptography for Security Managers
- Security Testing: Scanning, Pen Testing and Tracking Remediation
- Security Awareness Program Design
- Role-Based Security Training
- Phishing Simulations and Social Engineering Defences
- Third-Party Risk Management and Due Diligence
- Vendor Contracts, SLAs and Right to Audit
- Fourth-Party and Supply Chain Risk
- Outsourcing and Managed Security Services
- Security Stakeholder Communication
- Executive Dashboards and Board Reporting
- Continuous Improvement of the Security Program
Data Classification: Owners, Custodians and Users
Why classify?
Protecting every file to the highest level would be expensive and frustrating. Protecting nothing would be reckless. Classification sorts information by how much harm it could cause, so the program spends its effort where it matters.
Two dimensions are considered:
- Sensitivity: harm if the information is disclosed (confidentiality).
- Criticality: harm if it’s unavailable or corrupted (availability and integrity).
A typical scheme
| Level | Meaning | Examples |
|---|---|---|
| Public | Approved for release | Press releases, published prices |
| Internal | For staff; low harm if leaked | Internal procedures, staff directory |
| Confidential | Significant harm if leaked; need-to-know | Customer data, contracts |
| Restricted | Severe harm; strictest controls | Salaries, unreleased results, M&A plans |
Three to five levels is typical. Simple schemes are applied more consistently than complex ones.
Who does what
| Role | Responsibilities |
|---|---|
| Information owner (business manager) | Classifies the information, approves access, accepts residual risk, reviews periodically |
| Custodian (usually IT) | Implements the required controls: access setup, backups, encryption; reports issues |
| User | Uses information as authorised; follows handling rules; reports incidents |
IT and security provide the scheme and tools. They don’t classify information on the business’s behalf.
Levels drive handling rules
For each level, the program defines rules for access approval, encryption, labelling, approved storage locations, transmission channels, retention and secure disposal. Rules are written once per level, not once per document, which is what makes classification practical.
Making it work in practice
- Keep the scheme simple.
- Default unlabelled data to a protective level, such as internal.
- Use tools: automatic labelling, and DLP rules linked to labels.
- Train users with real examples from their own work.
- Review classifications when data’s value changes. Results become public after they’re announced, for example.
- Remember aggregation: combined data can be more sensitive than its parts.
Example. A company’s DLP tool blocked nothing, because almost no documents were labelled. After switching to automatic labelling of documents containing customer account numbers, and defaulting new files to “internal”, DLP started catching real leaks.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| Who decides the classification? | The information owner |
| Main benefit of classification | Cost-effective, proportionate protection |
| The custodian’s role | Implement the controls the owner requires |
| What comes before classifying? | Identifying and inventorying information |
| Data becomes less sensitive over time | The owner reviews and reclassifies it |
In short
- Data classification groups information by sensitivity (harm if disclosed) and criticality (harm if unavailable or corrupted), so protection is proportionate.
- The information owner, a business manager, decides the classification and reviews it periodically.
- Custodians (usually IT) implement the controls the classification requires; users follow the handling rules.
- Each level has handling rules for access, encryption, labelling, storage, transmission, retention and disposal.
- Typical schemes have three to five levels; simple schemes are applied more consistently.
- Classification makes cost-effective protection possible: strong controls where they matter, lighter ones elsewhere.
Exam traps
- IT or security doesn't decide classification; the owner does.
- Too many levels confuse users and lead to inconsistent labelling.
- Classification must be reviewed: sensitivity changes over time (e.g. results become public).
- Aggregated data can be more sensitive than its parts.
Slides
Click the slide and use the arrow keys. F toggles full screen.
A typical scheme
Who does what
Levels drive handling rules
1 / 9