2.6 KiB
2.6 KiB
Data Classification & Handling Guidance
Document owner: [Owner/Role]
Approved by: [Steering Committee / CISO]
Effective date: [YYYY-MM-DD]
Review cadence: [Annually]
1. Purpose & Scope
Implementation guidance for the Data Classification & Handling Policy. Applies to IT, data owners, and system owners implementing labeling and handling controls.
2. Labeling — How To
- M365/Entra: Use Microsoft Purview sensitivity labels mapped 1:1 to TLP levels (CLEAR/GREEN/AMBER/AMBER+STRICT/RED). Auto-apply default label per site/library; require justification to downgrade.
- Cloud storage (S3/Blob/GCS): Use bucket/object tags (
classification=TLP-AMBER) enforced by policy-as-code (bucket policy or Conditional Access) rather than convention alone. - Code repositories: Classification lives in the repo's README/CODEOWNERS metadata, not per-file — a repo touching RED material (e.g., PKI root config) is RED end-to-end.
- Physical documents: Header/footer stamp with TLP marking; RED documents numbered and logged at checkout.
3. Worked Examples
| Data | Classification | Why |
|---|---|---|
| Published blog post | TLP:CLEAR | Meant for public consumption |
| Internal engineering wiki | TLP:GREEN | All staff, not for external release |
| Customer contract | TLP:AMBER | Need-to-know within org |
| Pending acquisition terms | TLP:AMBER+STRICT | Named individuals, market-moving if leaked |
| Break-glass credentials, PKI root passphrase | TLP:RED | Compromise is existential — see Authentication Policy §2.1 kill-chain tier |
| Active incident forensics (mid-investigation) | TLP:RED → reclassify to TLP:AMBER once resolved | Protects investigation in progress; declassify per §3.4 once closed |
4. DLP & Technical Enforcement Checklist
✅ Sensitivity labels configured and auto-applied by default location.
✅ DLP policy blocks external email/share for AMBER+STRICT and RED labels.
✅ Encryption at rest enabled for all AMBER and above (see Password Policy §2.7 for algorithm standards).
✅ Access logging enabled for AMBER+STRICT/RED storage locations.
✅ Quarterly review of unlabeled/default-classified content for drift.
✅ Printing/physical controls documented for RED material, if applicable.