Documenting how to handle confidential criteria

The goals of data classification are listed below:

• Availability, integrity and confidentiality are provided at the necessary levels for all identified assets
• Return on investment by implementing controls where they are needed the most
• Map data protection levels with organizational needs
• Mitigate threats of unauthorized access and disclosure
• Comply with legal and regulation requirements

The steps to develop and roll out a data classification program are:

1. Compile an inventory of all information assets
2. 
   
3. Define levels of protection for information assets
4. 
   
5. Define a classification criteria
6. 
   
7. Develop information classification policy
8. 
   
9. Define information handling and labeling procedures
10. 
    
11. Assign responsibility for classification to the owner of information
12. 
    
13. Assign a security classification to all information assets
14. 
    
15. Classify information according to sensitivity and how much protection is required
16. 
    
17. Apply the classification system to documents, records, data files, and disks.
18. 
    
19. Develop information handling procedures for each class of information
20. 
    
21. Develop information labeling procedures for each class of information
22. 
    
23. Integrate into security awareness and training programs
24. 
    

You should have a data classification policy that covers the following:

• Information as assets of individual business units
• 
  
• Declare business unit managers as information owners
• 
  
• Declare IT as data custodians
• 
  
• Classification scheme
• 
  
• Definitions for each classification
• 
  
• Criteria for each classification
• 
  
• Roles and responsibilities of classification
• 
  

Your written procedures and guidelines should address the following;

• How to classify information
• How to change classification level if needed
• How to communicate classification change to IT
• Periodic review of
  • Current classification levels and mapping to business needs
  • Current access rights and privileges
  • Protection levels that current controls are using

The NIST 800-60 document may be too "DoD centric" and an overkill for your needs, but this document has the necessary guidelines to develop and maintain a structured data classification program.

Sun provides a more digestible and understandable approach, which can be found at http://www.sun.com/blueprints/tools/samp_sec_pol.pdf

Lastly, this link provides detailed guidelines for how to treat different types of data.