Topics in this domain
- Enterprise Architecture and IT Risk
- Change Management Risk
- Assets, Configuration and Dependencies
- Incident and Problem Management Oversight
- Project Governance and IT Risk
- Governing the Secure SDLC
- DevOps, CI/CD and Agile Delivery Risk
- Testing, Release and Deployment Risk
- Data Classification, Ownership and Handling
- Data Lifecycle: Integrity, Retention and Disposal
- Business Continuity Planning and Governance
- Disaster Recovery and Testing Recovery Capability
- Emerging Technology Risk: Cloud, IoT and OT
- AI and Machine Learning Risk
- Setting Risk Boundaries for Innovation
- Core Security Concepts: CIA, IAM, Cryptography and Network Security
- Security Frameworks and Control Standards
- Security Awareness Culture and Measuring Training
- Privacy Governance and Data Protection Principles
- Developing a Data Protection Control Strategy
Data Classification, Ownership and Handling
Classification levels
Classification matches protection to the value and sensitivity of data.
Who does what
Handling rules
Example. Staff labelled 80% of documents “restricted” to be safe. Restricted handling became impossible to follow, so people ignored it. Simplifying to four levels with clear examples brought restricted down to 5% and compliance up.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| Who classifies data | The data owner |
| MAIN benefit of classification | Protection matched to value |
| Result of over-classification | Wasted cost and ignored labels |
| Classification without handling rules | Ineffective; define rules for each level |
In short
- Classification matches protection to the value and sensitivity of data.
- Data owners, who are business managers, set classification; custodians implement the controls; users follow the rules.
- Three to five levels is typical; too many confuses people.
- Each level needs clear handling rules for storage, sharing and disposal.
- Classification is reviewed as data's sensitivity changes.
Exam traps
- Letting IT classify business data.
- Over-classifying everything, which makes labels meaningless.
- Classification levels with no handling rules.
- Never reviewing classifications after events such as public announcements.
Slides
Click the slide and use the arrow keys. F toggles full screen.
Classification levels
Who does what
Handling rules
ExampleStaff labelled 80% of documents 'restricted' to be safe. Restricted handling became impossible to follow, so people ignored it. Simplifying to four levels with clear examples brought restricted down to 5% and compliance up.
1 / 7