60. Data Classifications

Data Classification

Category based on the organization’s value and the sensitivity of the information if it were to be disclosed

Who decides data classification?

Data Owner

Sensitive Data

Any info that can result in a loss of security or a loss of advantage to a company if accessed by an unauthorized person

Commercial Business Classification Levels

Public

Sensitive

Private

Confidential

Government Classification Levels

Unclassified

Sensitive but Unclassified

Confidential

Secret

Top Secret

Data Lifecycle

Collect

Retain

Dispose

(Commercial) Public Data

Has no impact on the company if released and is often posted in an open-source environment

(Commercial) Sensitive Data

Has minimal impact if released, such as organization's financial data

(Commercial) Private Data

Contains data that should only be used within the organization; Relates to an individual entity

(Commercial) Confidential Data

Contains items such as trade secrets, intellectual property data, and source code that affects the business if disclosed

Critical

Contains valuable information, like credit card info

(Government) Unclassified

Data that can be released to the public or under the Freedom of Information Act

(Government) Sensitive but Unclassified

Data that would not hurt national security if released but could impact those whose data was being used

(Government) Confidential

Data that could seriously affect the government if unauthorized disclosures happen

(Government) Secret

Data that could seriously damage national security if disclosed

(Government) Top Secret

Data that would damage national security if disclosed