Data classification is the practice of sorting information into levels based on how much harm would follow if it were exposed, changed or lost, so that protection can match the level. Start with three or four levels, name an owner for each data set, and tie each level to specific controls.
Where does the idea come from?
The US federal model is a good reference even if you are not a federal agency. FIPS 199 sets a standard for categorizing federal information and information systems according to an agency's level of concern for confidentiality, integrity and availability, and the potential impact if they are compromised. The three ratings it uses are low, moderate and high. The point is the method: judge confidentiality, integrity and availability separately, then act on the highest.
NIST SP 800-60 supplies a guide for mapping types of information to those categories. It exists because teams argue less when a published list says where "payroll records" or "building plans" sit.
NIST SP 800-171 Revision 3, on protecting controlled unclassified information in nonfederal systems, shows what happens when classification meets contracts. If you hold such data for a federal customer, the label brings a defined set of security requirements with it.
What makes a classification scheme work?
Few levels. Four levels people remember beat ten they ignore. A common shape is public, internal, confidential and restricted.
Plain definitions. "Customer email addresses with names: confidential" is a rule. "Sensitive data" is not.
Owners. Someone with authority over each data set decides its level.
Controls attached. Each level lists what is required: where it may be stored, who may access it, encryption, retention, how it may be shared.
Default for the unlabeled. Decide what happens to data nobody has labeled. A cautious default prompts people to label.
What does a constructed example look like?
A 60-person software company makes four levels. Marketing copy is public. Internal wikis are internal. Customer lists and source code are confidential. Production database exports and private keys are restricted. Restricted data may live only in two named systems, needs multifactor login, and every access is logged. After three months, the team finds a restricted export in a shared drive. The label gave them a rule to enforce, and the finding is what the scheme is for.
Where does classification go wrong?
Over-classifying everything, which makes the labels meaningless. Treating classification as a one-time project with no review. Labelling files while ignoring where the data flows: copies in logs, backups and test environments are often the leak. And relying on users to tag every file by hand, which fails without tooling and defaults.
How do labels connect to technical controls?
A label only matters if something enforces it. Storage policies can restrict restricted data to approved locations. Access tools can require a higher bar of login for the top levels. Retention settings can differ by level, so low-value data expires sooner. Sharing tools can block external links on confidential files. Start with two or three of these enforcement points, rather than waiting for a perfect tool, and add more as the labels settle.
How to check or apply this
- Pick three or four levels and write one-line definitions with examples.
- List your main data sets and assign an owner and a level to each.
- For each level, write the required controls in a single table.
- Find where restricted data lives, including copies in backups, logs and analytics stores.
- Set a default level for anything unlabeled.
- Add automated discovery for the highest levels, so you find what people forgot.
- Review the labels each year, and when a data set changes purpose.
Quick check
How many classification levels do you need?
Three or four is enough for most companies. More levels raise the chance people pick the wrong one.
Is classification the same as encryption?
No. Classification decides how much protection data needs. Encryption is one of the controls that protection can include.
Sources
- NIST FIPS 199, Standards for Security Categorization of Federal Information and Information Systems
- NIST SP 800-60 Vol. 1 Rev. 1, Guide for Mapping Types of Information and Information Systems to Security Categories
- NIST SP 800-171 Rev. 3, Protecting Controlled Unclassified Information
Last reviewed: 18 October 2026.
