AWS/Whitepaper/Data Classification/Models and Schemes

• Data classification models and schemes - Data Classification

  • Five-Tier Data/Classification/Levels

    • Washington, D.C.

      • The city of Washington, D.C. implemented a new data policy in 2017 focused on being more transparent, while still protecting sensitive data. While Washington D.C. implemented a five-tier model, these tiers can align with other widely-adopted three-tier classification schemes used in cloud accreditation regimes.
        • Level 0 — Open Data. Data readily available to the public on open government websites and datasets.
        • Level 1 — Public Data, Not Proactively Released. Data not protected from public disclosure or subject to withholding under any law, regulation, or contract. Publication of the data on the public Internet would have the potential to jeopardize the safety, privacy, or security of anyone identified in the information.
        • Level 2 — For District Government Use. Data that is not highly sensitive and may be distributed within the government without restriction by law, regulation, or contract. It is primarily daily government business operations data.
        • Level 3 — Confidential. Data protected from disclosure by law, regulation, or contract and that is either highly sensitive or is lawfully, or contractually restricted from disclosure to other public bodies. This includes privacy-related data (such as PII, PHI, payment card industry data security standard (PCI DSS), federal tax information (FTI), and so on.
        • Level 4 — Restricted Confidential. Data that unauthorized disclosure could potentially cause major damage or injury, including death to those identified in the information, or otherwise significantly impair the ability of the agency to perform its statutory functions.

    • Table 1 — Five-tiered commercial data classification approach according to the book CISSP Security Management and Practices

      • Classification	Description
        Sensitive	Data that is to have the most limited access and requires a high degree of integrity. This is typically data that will do the most damage to the organization should it be disclosed.
        Confidential	Data that might be less restrictive within the company but might cause damage if disclosed.
        Private	Private data is usually compartmental data that might not do the company damage but must be kept private for other reasons. Human resources data is one example of data that can be classified as private.
        Proprietary	Proprietary data is data that is disclosed outside the company on a limited basis or contains information that could reduce the company's competitive advantage, such as the technical specifications of a new product.
        Public	Public data is the least sensitive data used by the company and would cause the least harm if disclosed. This could be anything from data used for marketing to the number of employees in the company.