Tiedon merkintä

Data classification can be used to give data processors a quick view of how critical data is and how data should be processed and protected.

The data categories used and the corresponding security levels are defined. The category of information is defined by analyzing the confidentiality, integrity and availability of the information in question, as well as any other requirements. Each level is given a clear and descriptive name.

Data classifications can be, for example, the following:

• disclosure of information does not cause harm (PUBLIC)
• disclosure of information causes slight inconvenience or minor operational annoyance (CONFIDENTIAL)
• disclosure of information has significant short-term effects on operations or tactical objectives (LIMITED)
• disclosure of information has serious implications for long-term strategic objectives or jeopardizes the very existence of the organization (PROHIBITED)

CONFIDENTIAL paper information may require e.g. the following protections:

• Locked cabinet
• Trusted transfer partner
• Sealed envelopes
• Safe disposal process

CONFIDENTIAL electronic information may require e.g. the following protections:

• Use the selected encryption level
• Password protection
• Safe disposal process
• More limited access rights

The ways in which information is classified and classifications marked are defined, markings are easily identifiable and they cover both physical and electronic information and assets. The marking must indicate to what extent the document is to be kept secret and on what basis the secrecy is based. Personnel are instructed on how to make markings.

There are agreed procedures for identifying and marking media that require safe disposal.