Data classification can be used to give data processors a quick view of how critical data is and how data should be processed and protected.
The data categories used and the corresponding security levels are defined. The category of information is defined by analyzing the confidentiality, integrity and availability of the information in question, as well as any other requirements. Each level is given a clear and descriptive name.
Data classifications can be, for example, the following:
CONFIDENTIAL paper information may require e.g. the following protections:
CONFIDENTIAL electronic information may require e.g. the following protections:
The functionality and consistency of the data classification is regularly reviewed in the organization as a whole.
The principles of data classification should be consistent throughout the organization so that everyone has a common understanding of security requirements and equally critical protection is applied to equally critical information.