What is the best practice when classifying data into private, public, confidential etc.. Is data classification part of the central policy or is it decentralised? What are the challenges faced by US government when classifying data and how was the challenges overcome?

  • 1
    As this forum is for 'open data', I'm going to have to say that the best practice is to make everything open.
    – Joe
    Feb 5 '15 at 20:25

The state of Washington adopted a standard for data classification that has worked pretty well for us:

 (1) Category 1 - Public Information
Public information is information that can be or currently is released to the public.  It does not need protection from unauthorized disclosure, but does need integrity and availability protection controls.
(2) Category 2 - Sensitive Information
Sensitive information may not be specifically protected from disclosure by law and is for official use only. Sensitive information is generally not released to the public unless specifically requested.
(3) Category 3 - Confidential Information
Confidential information is information that is specifically protected from disclosure by law.  It may include but is not limited to:
    a. Personal information about individuals, regardless of how that information is obtained.
    b. Information concerning employee personnel records.
    c. Information regarding IT infrastructure and security of computer and telecommunications systems.
(4) Category 4 - Confidential Information Requiring Special Handling
Confidential information requiring special handling is information that is specifically protected from disclosure by law and for which:
    a. Especially strict handling requirements are dictated, such as by statutes, regulations, or agreements.
    b. Serious consequences could arise from unauthorized disclosure, such as threats to health and safety, or legal sanctions.


Not the answer you're looking for? Browse other questions tagged or ask your own question.