Documenting how to handle confidential criteria

The goals of data classification are listed below:

• Availability, integrity and confidentiality are provided at the necessary levels for all identified assets
• Return on investment by implementing controls where they are needed the most
• Map data protection levels with organizational needs
• Mitigate threats of unauthorized access and disclosure
• Comply with legal and regulation requirements

The steps to develop and roll out a data classification program are:

1. Compile an inventory of all information assets


2. Define levels of protection for information assets


3. Define a classification criteria


4. Develop information classification policy


5. Define information handling and labeling procedures


6. Assign responsibility for classification to the owner of information


7. Assign a security classification to all information assets


8. Classify information according to sensitivity and how much protection is required


9. Apply the classification system to documents, records, data files, and disks.


10. Develop information handling procedures for each class of information


11. Develop information labeling procedures for each class of information


12. Integrate into security awareness and training programs

You should have a data classification policy that covers the following:

• Information as assets of individual business units


• Declare business unit managers as information owners


• Declare IT as data custodians


• Classification scheme


• Definitions for each classification


• Criteria for each classification


• Roles and responsibilities of classification

Your written procedures and guidelines should address the following;

• How to classify information
• How to change classification level if needed
• How to communicate classification change to IT
• Periodic review of
• Current classification levels and mapping to business needs
• Current access rights and privileges
• Protection levels that current controls are using

The NIST 800-60 document may be too "DoD centric" and an overkill for your needs, but this document has the necessary guidelines to develop and maintain a structured data classification program.

Sun provides a more digestible and understandable approach, which can be found at http://www.sun.com/blueprints/tools/samp_sec_pol.pdf

Lastly, this link provides detailed guidelines for how to treat different types of data.