Classify by consequence and handling
Classification should change a decision. Define a small number of levels based on harm from unauthorised disclosure, alteration or loss of availability. For each level, state practical handling expectations for access, external sharing, devices, encryption, retention and disposal.
Use examples from the organisation’s real work: customer records, contracts, credentials, public material and operational telemetry. Avoid labels that require legal interpretation from every employee. Where regulation or contract adds requirements, connect the requirement to the handling rule and responsible owner.
Apply labels where work happens
Integrate classification into document, application and data workflows rather than relying on a policy PDF. Default important systems sensibly and allow owners to correct classification with an audit trail. Automated discovery can assist, but context and purpose often require human judgement.
Separate classification from access approval. A sensitive label informs policy, while identity, role and business need still determine who may act. Design a clear process for external sharing and exceptions so users do not create uncontrolled copies to complete legitimate work.
Measure behaviour and reduce clutter
Review overclassification, unlabelled repositories, public sharing and retention conflicts. If nearly everything receives the highest label, the model is not helping teams prioritise. Focus improvements on important services and repeated handling failures.
During incidents, classification should help responders identify affected data, owners and notification inputs. Test whether the inventory and labels support that question. Update examples and controls when business processes or legal advice changes, and communicate the reasons in plain language.
What to do next.
- ✓Use a small number of consequence-based levels.
- ✓Define handling rules for each level.
- ✓Provide examples from real business information.
- ✓Integrate labels with normal applications and workflows.
- ✓Create an auditable external-sharing route.
- ✓Test whether classification supports incident scoping.
Use guidance responsibly
Technology, provider behaviour and legal requirements change. Validate implementation details against current official documentation, test changes safely and obtain qualified legal advice where required.