Purpose
Classification helps people and systems make consistent handling decisions. It should connect to actual controls rather than exist only as labels in policy.
Classification inputs
- Business value and operational dependency
- Legal, regulatory, contractual, and privacy obligations
- Impact of unauthorized disclosure or change
- Required availability and recovery
- Data subject, owner, location, and lifecycle stage
Control connections
Classification can drive access, encryption, sharing restrictions, storage location, retention, backup, logging, data-loss prevention, and destruction.
Keep it usable
Too many categories and exceptions create confusion. A smaller model with clear examples, ownership, and automated support is often stronger than a complex scheme nobody applies.
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: