Data Classification: Public, Internal, Confidential, and Restricted
Security controls should become stronger as the sensitivity and impact of unauthorized disclosure increase.
Public data
Public data is approved for broad disclosure and typically requires the least restrictive confidentiality controls.
Internal data
Internal information is intended for organizational use and should not be treated as public by default.
Confidential data
Confidential information requires stronger need-to-know access and protection because disclosure could create meaningful harm.
Restricted data
Restricted or highly sensitive data generally receives the strongest controls, monitoring, encryption, and handling requirements.
The takeaway
Data classification translates sensitivity into concrete handling and access requirements, with stronger controls for higher-impact information.
Related Summit resources
FAQ
What is the key distinction?
Data classification translates sensitivity into concrete handling and access requirements, with stronger controls for higher-impact information.
What should I identify first?
Security controls should become stronger as the sensitivity and impact of unauthorized disclosure increase.
Why is this tested?
Understand how data sensitivity classifications drive access, handling, storage, transmission, and disposal controls.