Establish and Maintain a Data Classification Scheme
Description
Establish and maintain an overall data classification scheme for the enterprise. Enterprises may use labels, such as “Sensitive,” “Confidential,” and “Public,” and classify their data according to those labels. Review and update the classification scheme annually, or when significant enterprise changes occur that could impact this Safeguard.
Implementation Checklist
Tool Recommendations
Data governance and compliance platform with DLP, information protection, sensitivity labels, and insider risk management
Microsoft · Per-user subscription (E5/standalone)
Enterprise data loss prevention covering endpoint, network, storage, and cloud channels with policy-based content inspection
Broadcom · Enterprise license
Cloud-native DLP and CASB platform providing inline data protection for SaaS, IaaS, web, and endpoint
Netskope · Per-user subscription
Threats & Vulnerabilities (CIS RAM)
Threat Scenarios
Mishandling of Sensitive Data Due to Unknown Classification
ConfidentialityEmployees share, store, or transmit highly sensitive data using insecure channels because there is no classification scheme to communicate the data's sensitivity level.
Insufficient Protection for High-Value Data
ConfidentialityWithout classification labels, all data receives the same baseline protection level, leaving highly sensitive data with inadequate controls while over-protecting low-value data.
Vulnerabilities (When Safeguard Absent)
No Data Classification Scheme
Without defined classification labels and criteria, employees have no framework for determining how to handle data, leading to inconsistent and often inadequate protection.
Unable to Apply Risk-Based Data Protections
Without classification, security controls cannot be proportionally applied based on data sensitivity, resulting in either excessive cost or insufficient protection.
Evidence Requirements
| Type | Evidence Item | Collection Frequency |
|---|---|---|
| Document | Current inventory or catalog documentation | Maintained continuously, reviewed quarterly |
| Document | Process/procedure documentation for identification activities | Reviewed annually |
| Document | Governing policy document (current, approved, communicated) | Reviewed annually |