# Data Classification & Handling Guidance

**Document owner:** [Owner/Role]  
**Approved by:** [Steering Committee / CISO]  
**Effective date:** [YYYY-MM-DD]  
**Review cadence:** [Annually]

---

## 1. Purpose & Scope
Implementation guidance for the [Data Classification & Handling Policy](data_classification_policy.md). Applies to IT, data owners, and system owners implementing labeling and handling controls.

---

## 2. Labeling — How To

- **M365/Entra:** Use Microsoft Purview sensitivity labels mapped 1:1 to TLP levels (CLEAR/GREEN/AMBER/AMBER+STRICT/RED). Auto-apply default label per site/library; require justification to downgrade.  
- **Cloud storage (S3/Blob/GCS):** Use bucket/object tags (`classification=TLP-AMBER`) enforced by policy-as-code (bucket policy or Conditional Access) rather than convention alone.  
- **Code repositories:** Classification lives in the repo's README/CODEOWNERS metadata, not per-file — a repo touching RED material (e.g., PKI root config) is RED end-to-end.  
- **Physical documents:** Header/footer stamp with TLP marking; RED documents numbered and logged at checkout.

## 3. Worked Examples

| Data | Classification | Why |
|---|---|---|
| Published blog post | TLP:CLEAR | Meant for public consumption |
| Internal engineering wiki | TLP:GREEN | All staff, not for external release |
| Customer contract | TLP:AMBER | Need-to-know within org |
| Pending acquisition terms | TLP:AMBER+STRICT | Named individuals, market-moving if leaked |
| Break-glass credentials, PKI root passphrase | TLP:RED | Compromise is existential — see [Authentication Policy §2.1 kill-chain tier](authentication_policy.md) |
| Active incident forensics (mid-investigation) | TLP:RED → reclassify to TLP:AMBER once resolved | Protects investigation in progress; declassify per §3.4 once closed |

## 4. DLP & Technical Enforcement Checklist
✅ Sensitivity labels configured and auto-applied by default location.  
✅ DLP policy blocks external email/share for AMBER+STRICT and RED labels.  
✅ Encryption at rest enabled for all AMBER and above (see [Password Policy §2.7](password_policy_generic.md) for algorithm standards).  
✅ Access logging enabled for AMBER+STRICT/RED storage locations.  
✅ Quarterly review of unlabeled/default-classified content for drift.  
✅ Printing/physical controls documented for RED material, if applicable.

---

## 5. References
- **[FIRST.org Traffic Light Protocol (TLP) 2.0](https://www.first.org/tlp/)**  
- **[NIST SP 800-60 Vol. 1 Rev. 1](https://csrc.nist.gov/pubs/sp/800/60/v1/r1/final)**  
- **[ISO/IEC 27001:2022](https://www.iso.org/standard/27001)**