Data Classification
Data classification is the practice of assigning sensitivity levels to your data — public, internal, confidential, restricted — so that controls scale with risk instead of applying uniformly. It’s what lets you say “restricted data never leaves these systems” and mean something specific.
A scheme that survives contact with reality
Four tiers, defined by consequence: Public (published without harm), Internal (embarrassing to leak, not damaging), Confidential (customer data, contracts — leak harms the business), Restricted (credentials, PHI, cardholder data — leak triggers legal and regulatory consequences). Each tier maps to handling rules: where it may live, who may access it (least privilege applied per tier), how it’s encrypted, how long it’s retained, how it’s destroyed.
Where classification actually happens
Not in employees’ heads per-document — in system defaults. Classify systems and stores, not individual files: everything in the production database is Confidential-or-above by definition; everything in the credentials manager is Restricted. Per-file classification programs fail at startups because they tax every document decision; per-system classification works because it taxes only architecture decisions.
What auditors sample
The scheme’s existence in policy, evidence that handling rules follow the tiers (encryption on Confidential stores, access reviews on Restricted systems), and retention actually executing. The recurring finding: a beautiful four-tier scheme and a data inventory that was never mapped to it — classification as literature rather than configuration.
Business Continuity Plan (BCP) — A business continuity plan keeps the business running through disruption; disaster recovery restores the systems. Auditors expect both — and a test record.
Least Privilege — Least privilege means every identity gets the minimum access its role requires — the principle behind access reviews, role design, and most audit samples.