data classification

public data

the least sensitive, has no restrictions, is publicly available

internal data

available to anybody within the company and therefore is minimally sensitive. it isn’t public facing, but exposing this data wouldn’t violate laws or consumer trust. includes project plans, business processes, and organizational charts

confidential data

sensitive data with limited access. the information is only available to authorized users either on a role or case by case basis. generally, this category includes sensitive information that people need to do their job

ex: PHI, PII

restricted data

most sensitive data. access is severely restricted and is granted on a need to know basis with strict business jsutification. example: merger documents, employee info like SSI