What is the best practice when classifying data into private, public, confidential etc.. Is data classification part of the central policy or is it decentralised? What are the challenges faced by US government when classifying data and how was the challenges overcome?
The state of Washington adopted a standard for data classification that has worked pretty well for us:
(1) Category 1 - Public Information Public information is information that can be or currently is released to the public. It does not need protection from unauthorized disclosure, but does need integrity and availability protection controls. (2) Category 2 - Sensitive Information Sensitive information may not be specifically protected from disclosure by law and is for official use only. Sensitive information is generally not released to the public unless specifically requested. (3) Category 3 - Confidential Information Confidential information is information that is specifically protected from disclosure by law. It may include but is not limited to: a. Personal information about individuals, regardless of how that information is obtained. b. Information concerning employee personnel records. c. Information regarding IT infrastructure and security of computer and telecommunications systems. (4) Category 4 - Confidential Information Requiring Special Handling Confidential information requiring special handling is information that is specifically protected from disclosure by law and for which: a. Especially strict handling requirements are dictated, such as by statutes, regulations, or agreements. b. Serious consequences could arise from unauthorized disclosure, such as threats to health and safety, or legal sanctions.