Add AGENTS.md guidance and expand Security policy library

Security/data_classification_guidance.md

@@ -0,0 +1,46 @@
+# Data Classification & Handling Guidance
+
+**Document owner:** [Owner/Role]  
+**Approved by:** [Steering Committee / CISO]  
+**Effective date:** [YYYY-MM-DD]  
+**Review cadence:** [Annually]
+
+---
+
+## 1. Purpose & Scope
+Implementation guidance for the [Data Classification & Handling Policy](data_classification_policy.md). Applies to IT, data owners, and system owners implementing labeling and handling controls.
+
+---
+
+## 2. Labeling — How To
+
+- **M365/Entra:** Use Microsoft Purview sensitivity labels mapped 1:1 to TLP levels (CLEAR/GREEN/AMBER/AMBER+STRICT/RED). Auto-apply default label per site/library; require justification to downgrade.  
+- **Cloud storage (S3/Blob/GCS):** Use bucket/object tags (`classification=TLP-AMBER`) enforced by policy-as-code (bucket policy or Conditional Access) rather than convention alone.  
+- **Code repositories:** Classification lives in the repo's README/CODEOWNERS metadata, not per-file — a repo touching RED material (e.g., PKI root config) is RED end-to-end.  
+- **Physical documents:** Header/footer stamp with TLP marking; RED documents numbered and logged at checkout.
+
+## 3. Worked Examples
+
+| Data | Classification | Why |
+|---|---|---|
+| Published blog post | TLP:CLEAR | Meant for public consumption |
+| Internal engineering wiki | TLP:GREEN | All staff, not for external release |
+| Customer contract | TLP:AMBER | Need-to-know within org |
+| Pending acquisition terms | TLP:AMBER+STRICT | Named individuals, market-moving if leaked |
+| Break-glass credentials, PKI root passphrase | TLP:RED | Compromise is existential — see [Authentication Policy §2.1 kill-chain tier](authentication_policy.md) |
+| Active incident forensics (mid-investigation) | TLP:RED → reclassify to TLP:AMBER once resolved | Protects investigation in progress; declassify per §3.4 once closed |
+
+## 4. DLP & Technical Enforcement Checklist
+✅ Sensitivity labels configured and auto-applied by default location.  
+✅ DLP policy blocks external email/share for AMBER+STRICT and RED labels.  
+✅ Encryption at rest enabled for all AMBER and above (see [Password Policy §2.7](password_policy_generic.md) for algorithm standards).  
+✅ Access logging enabled for AMBER+STRICT/RED storage locations.  
+✅ Quarterly review of unlabeled/default-classified content for drift.  
+✅ Printing/physical controls documented for RED material, if applicable.
+
+---
+
+## 5. References
+- **[FIRST.org Traffic Light Protocol (TLP) 2.0](https://www.first.org/tlp/)**  
+- **[NIST SP 800-60 Vol. 1 Rev. 1](https://csrc.nist.gov/pubs/sp/800/60/v1/r1/final)**  
+- **[ISO/IEC 27001:2022](https://www.iso.org/standard/27001)**