Data Classification SOP¶

Sub-procedure for Innovate pillar digital transformation

Overview¶

This sub-procedure defines the methodology for classifying data assets based on sensitivity, regulatory requirements, and business impact. Classification enables appropriate security controls, access management, and compliance with data protection regulations.

Scope¶

Pillar: Innovate (Digital Transformation) Service Area: Data Governance Related Services: Compliance (HIPAA, SOC 2, PCI), Security

Prerequisites¶

Data inventory completed (system and asset level)
Data classification policy approved
Regulatory requirements identified (HIPAA, PCI, GDPR, etc.)
Classification schema defined and approved
Data owners identified and engaged
Classification tooling available (if automated)

Procedure¶

Step 1: Classification Framework Definition¶

Objective: Establish classification schema and criteria

Define classification levels:

Level	Label	Description	Examples
1	Public	No restrictions, publicly available	Marketing materials, public website
2	Internal	Internal use only, low sensitivity	Internal memos, org charts
3	Confidential	Business sensitive, restricted access	Financial data, contracts
4	Highly Confidential	Sensitive personal or regulated data	PII, PHI, payment data
5	Restricted	Highest sensitivity, strict controls	Trade secrets, credentials

Define classification criteria:
Regulatory applicability (HIPAA, PCI, GDPR)
Business impact if disclosed
Reputational impact
Legal/contractual requirements
Map regulations to data types
Define handling requirements per level
Document classification decision tree

Duration: 2-3 days Owner: Data Governance Lead / Security Lead

Step 2: Automated Discovery (if applicable)¶

Objective: Identify sensitive data using scanning tools

Configure data discovery tool:
Define scan targets (databases, files, cloud storage)
Configure detection patterns (SSN, credit card, PHI)
Set up sampling parameters
Execute discovery scans
Review and validate findings
Address false positives
Export discovery results for manual review

Duration: 3-5 days Owner: Data Engineer / Security Analyst

Step 3: Manual Classification Assessment¶

Objective: Classify data assets with business context

For each data asset/table:

Review data contents and purpose
Identify personal identifiable information (PII):
Names, addresses, phone numbers
Email addresses
Government IDs (SSN, passport)
Biometric data
Identify protected health information (PHI)
Identify financial/payment data (PCI scope)
Identify business confidential data
Assign classification level
Document classification rationale
Identify applicable regulations

Duration: 5-10 days (varies by scope) Owner: Data Analyst / Data Stewards

Step 4: Data Owner Validation¶

Objective: Validate classifications with data owners

Present classification results to data owners
Review classification rationale
Address disagreements and edge cases
Update classifications based on feedback
Obtain data owner approval
Document exceptions and rationale

Duration: 2-3 days Owner: Data Governance Lead

Step 5: Control Mapping¶

Objective: Map security controls to classification levels

Define control requirements per level:

Level	Access Control	Encryption	Logging	Retention	Disposal
Public	None	Optional	Basic	Flexible	Standard
Internal	Role-based	In transit	Standard	Policy-based	Standard
Confidential	Need-to-know	At rest + transit	Enhanced	Policy-based	Secure delete
Highly Confidential	Strict ACL	At rest + transit	Full audit	Regulatory	Certified disposal
Restricted	Explicit approval	Strong encryption	Full audit + alert	Minimal	Cryptographic erasure

Document control requirements
Identify control gaps
Create remediation roadmap
Prioritize based on risk

Duration: 2-3 days Owner: Security Lead

Step 6: Classification Publication¶

Objective: Publish and operationalize classifications

Update data catalog with classifications
Apply data labels/tags (if tooling supports)
Configure access controls based on classification
Update data handling procedures
Communicate classifications to stakeholders
Train data handlers on classification requirements
Establish classification review cadence (annual)