Use three or four plain labels, such as Restricted, Confidential, Internal and Public, attach one to each asset based on the most sensitive data it stores or processes, and use the label to move a finding up or down a tier. You do not need a full data governance program to start.
Why data sensitivity belongs in triage
A vulnerability scanner knows the flaw. It does not know what is behind it. Two services can carry an identical vulnerable library, and a breach of one exposes marketing copy while a breach of the other exposes payment records.
CVSS v4.0 reflects this idea in its Environmental group through the Confidentiality, Integrity and Availability Requirement metrics, which let you say how much loss of each property matters for the affected system. Values are High, Medium, Low or Not Defined. The specification notes that Not Defined has the same effect as assigning High, the worst case.
A starter scheme
| Label | What it covers | Triage effect |
|---|---|---|
| Restricted | Credentials, payment data, health or government identifiers, signing keys | Move up one tier |
| Confidential | Customer records, contracts, source code | Keep the base tier |
| Internal | Staff tools, non customer operational data | Move down one tier if not exposed |
| Public | Content already published | Move down one tier if not exposed |
Four labels are easier to apply than ten. If two people disagree on a label, the more sensitive one wins until the data owner decides.
How to assign labels in an afternoon
- Pick your twenty most important services.
- For each, ask the owning team one question: what is the worst data this service can read or write?
- Record the answer as a label in your asset inventory.
- Mark the rest Not Labelled and treat them as Confidential by default.
That default matters. An unlabelled asset should not silently count as harmless.
Pass through services
A service that only forwards data still touches it. If a gateway handles authentication tokens, the gateway deserves the label of the data it can see, even if it stores nothing. Ask what the service can read, not what it keeps.
Keep integrity and availability in view
Sensitivity is not only about secrecy. A flaw that lets an attacker change records in a billing system matters through integrity. A flaw that takes down a payment path matters through availability. When you label an asset, note which of the three properties matters most. A public status page may be low on confidentiality and still need high availability.
How the label meets the other signals
The label is one input. A Restricted asset with a flaw that is not reachable in the code and has no known exploitation may still sit below a Public asset with an exploited flaw. Combine the label with exposure, exploit evidence and reachability. NIST SP 800-40 Rev. 4 describes patching as part of preventive maintenance, and notes a frequent divide between business owners and security teams on its value. A data label gives both groups a shared word.
Maintenance
Review labels when a service gains a new data source, when a new integration connects, and when ownership changes. A label that was right at launch can be wrong after a feature ships.
Quick check
Do I need to classify all data first?
No. Label assets by the worst data they touch, starting with your most important services. Refine over time.
What if the owner will not pick a label?
Apply the default of Confidential and record that it is provisional. Revisit it at the next review.
Sources
- CVSS v4.0 Specification Document, FIRST
- NIST SP 800-40 Rev. 4, Guide to Enterprise Patch Management Planning
Last reviewed: 19 October 2026.
