What is data classification?
Data classification assigns each set of data a label that reflects how much harm its exposure, loss or corruption would cause, and the label decides how the data must be handled. Handling rules cover who may access it, whether it must be encrypted at rest and in transit, whether it may leave the company, where it may be stored, how long it is kept and how it is destroyed. Classification comes first because data cannot be protected in proportion to its value until someone has decided what that value is.
The data owner, a business leader accountable for the data set, assigns the label under the organization's classification policy. Custodians, usually in IT, then apply the controls that the label requires.
Government classification levels
The U.S. government uses three classification levels, defined in Executive Order 13526 and ranked by the damage unauthorized disclosure could reasonably be expected to cause to national security:
- Top Secret: exceptionally grave damage.
- Secret: serious damage.
- Confidential: damage. This is the lowest classified level.
Everything else is unclassified, though some unclassified information is still protected under the Controlled Unclassified Information (CUI) program. Access needs both a clearance at or above the data's level and a need to know. Because labels and clearances are set by central policy rather than by whoever holds the document, government classification is the classic example of mandatory access control.
Commercial classification labels
Businesses write their own schemes, usually with three to five tiers. Names vary, but these are common:
| Label | Typical meaning | Example |
|---|---|---|
| Public | Approved for anyone; no harm if disclosed | Press releases, published prices |
| Private or internal | Employees only; minor harm if exposed. Some schemes use private for personal information about staff or customers | Org charts, intranet pages |
| Confidential | Limited to those with a business need; significant harm | Customer lists, contracts, HR records |
| Restricted | Named individuals only; severe harm | Cardholder data, merger plans, signing keys |
The same word can mean different things in different schemes. Confidential is the lowest government classified level but a middle commercial tier. Restricted is not a U.S. government level at all; NATO uses it below Confidential, and many companies use it as their highest tier. Sensitive is used two ways: some schemes make it a tier, often between internal and confidential, but more often it is an umbrella term for any data whose exposure would harm a person or the business.
Critical is a different axis. It describes how badly the business needs the data to be available and correct, not how secret it is. A published flight schedule is public and critical. Criticality drives backups, redundancy and recovery targets, while sensitivity drives encryption and access restrictions. Public data still needs integrity: a defaced price list is an incident even though the list was never secret.
How labels drive controls
Labels matter only when tools act on them. A document carrying a Restricted sensitivity label can be encrypted automatically, blocked by DLP from being emailed to outside domains and visibly marked on every page. A database column of card numbers can be masked or tokenized for most users. Labels also set retention and disposal; a policy might require that media holding Restricted data be sanitized according to NIST SP 800-88 when retired. Over-classifying everything makes people ignore labels and slows work, while under-classifying lets sensitive data be handled like a press release.
Data classification on the CompTIA Security+ exam
Data classification falls under SY0-801 objective 3.3, which deals with knowing what data an organization holds and how it is protected. Expect questions that ask which label fits a description, which government level matches a damage statement (serious damage means Secret), who assigns the label (the data owner, not the CISO or a database administrator) and why public data still needs integrity protection. If a scenario stresses that the business would stop without the data even though it is not secret, the answer is critical. Distractors mix government and commercial terms, so check whether the scenario involves a government agency or contractor or a private business. Remember that classification is a labeling and policy decision; encryption, DLP and masking are the controls that enforce it.