A sales engineer copies a customer's network diagrams to a USB drive for an on-site visit. A cloud administrator creates a new storage bucket in whichever region is closest to the developer who asked. A records clerk deletes a folder of invoices from 2012. Each is a data handling decision, and each is either routine or a violation depending on the data's classification, where it sits in its life cycle and which rules govern it.
On the CompTIA Security+ SY0-801 exam this material sits under objective 3.3, which expects you to explain how organizations handle data day to day and meet the rules that apply to it. This lesson covers handling data on endpoints, marking and labeling, geofencing, data location and placement, the five stages of the data life cycle, and the main categories of regulated data.
Handling rules have to follow data onto every endpoint
Endpoints are where data leaves well-guarded servers and meets people: laptops, desktops, phones, tablets and the USB drives plugged into them. They are lost, stolen, shared with family members and infected far more often than servers, and they collect copies of data in places users forget about, such as the Downloads folder, sync clients, browser caches and email attachments saved to the desktop.
Handling procedures tie what may happen on an endpoint to the data's classification. A typical policy says Restricted data may never be copied to removable media, Confidential data may be stored only on encrypted company devices, and Public data has no endpoint restrictions. The technical controls enforce those rules:
- Full-disk encryption, so a lost laptop exposes nothing.
- Mobile device management (MDM), which enforces PINs and encryption, separates work data from personal data in a work profile, and can wipe corporate data from a lost or departing employee's phone.
- Endpoint DLP agents that block copying labeled files to USB drives, uploading them to personal cloud storage or printing them.
- Removable media restrictions, such as the Windows Group Policy setting "All Removable Storage classes: Deny all access".
- Virtual desktops or browser-only access, so sensitive data is viewed on the endpoint but never stored there.
On the exam, a scenario about sensitive files leaving on USB drives or personal phones points to endpoint controls such as DLP, MDM and encryption, not to network controls that never see the copy happen.
Marking and labeling make a classification visible to people and to systems
A classification policy does nothing if nobody can tell what class a file belongs to. Marking and labeling solve that, and while CompTIA lists them together and many organizations use the words interchangeably, a useful distinction is that markings are for people and labels are for systems.
Markings are visible: a "CONFIDENTIAL" header and footer on each page, a watermark across a draft, a cover sheet, a tag in an email subject line, or a sticker on a backup tape or hard drive. They tell a reader how to handle what's in front of them, and they tell the people who move, store and destroy physical media which rules apply.
Labels are metadata stored with the file or message, which software can read and act on. Sensitivity labeling tools, such as the labels in Microsoft Purview, write the classification into the document's metadata, where it stays when the file is copied or emailed. Labels can be applied by the user, set by default, or applied automatically when content inspection finds something like a list of card numbers. Once data carries a label, other controls can act on it without anyone reading the file:
Rule: Block external sharing of Restricted files
Condition: sensitivity label = Restricted
AND recipient domain is not corp.example
Action: block send, notify the user, alert the security team
Many labeling tools can also apply the visual markings and encryption that a label requires, so one decision by the user or the scanner sets all three.
On the exam, a question about making DLP, email gateways or cloud access controls enforce a classification automatically points to labeling. A question about making sure people handling a document or a drive know its classification points to marking.