Information classification

What it means

Information classification is the sorting of company data into groups according to the harm its leak, alteration or loss would cause. Four levels are common: public, internal, confidential and strictly confidential. Each level comes with rules on who may access the data, where it may be stored, how it is sent and how it is destroyed.

Public data includes website content or price lists, internal data organisational instructions, confidential data contracts, payroll, costings and clients’ personal data, and strictly confidential data things like planned acquisitions, access keys or sensitive personal data. Each company decides the exact classification according to its business.

Classification is a cornerstone of information security. Without it, access control, encryption or DLP cannot be set up sensibly, because the company does not know what it is protecting. It is required by ISO 27001, for example, and belongs in the security policy.

How it works in practice

We advise smaller companies to start simply: three or four levels, a short description with examples and a rule that an unlabelled document counts as internal. Confidential documents are labelled in the header or file name and stored in folders with restricted access.

For accounting and payroll data classification comes naturally: salaries, personnel files and national ID numbers are confidential and accessible only to those who need them. Likewise, a trade secret is protected in court only if the company has actually protected it as a secret, and classification is part of the evidence.

Classification also concerns suppliers. If the company sends confidential data to an external accountant, IT administrator or the cloud, the contract should include confidentiality and protection requirements that match the level of the data.

What to watch out for

The most common mistake is a system so complex that nobody uses it. With eight levels and hundreds of rules, people stop labelling documents and classification exists only on paper. A simple system that is followed beats a perfect one that is ignored.

The second mistake is classifying only documents and forgetting data in systems, emails or backups. Confidential data in an unencrypted backup on an external drive or in an old email attachment is just as exposed as paper left on a desk.