Data Classification

No organization can protect every record to the same maximum standard; budgets, performance, and usability forbid it. Classification is the move that makes the trade-off rational: rank information once by the harm its compromise would cause, attach a label, and let that label drive every downstream control from access to destruction. The CIA triad supplies the axes a label is actually grading, and the sharp distinction to hold onto is that they are two different axes, because a record can be high on one and low on the other.

Classification is the act of ranking information by the harm its compromise would cause, so protection can be made proportional to that harm. No organization can protect every record to the same maximum standard: budgets, performance, and usability forbid it. So you grade information once, attach a label, and let that label drive every downstream control: access decisions, storage and transmission requirements, marking, retention, and destruction. The label converts an open-ended question ("how hard should we protect this?") into a lookup against policy.

The harm a label captures runs along two distinct axes, and a careful reader must keep them apart because a record can be high on one and low on the other. The diagram above groups each axis with the CIA objective it grades:

• Sensitivity: how damaging unauthorized disclosure or modification would be. This is a confidentiality and integrity concern. Trade secrets, personal data, and pre-release financials are highly sensitive.
• Criticality: how damaging it would be if the information or system were unavailable when needed. This is an availability concern. A public product catalog is not sensitive, but if it drives live order processing it can be highly critical.

NIST FIPS 199^[1] formalizes this by rating the confidentiality, integrity, and availability impact of an information type independently, each as LOW, MODERATE, or HIGH: three ratings, not one combined score. That independence is the point: it lets a record be, say, HIGH for confidentiality but LOW for availability. When an exam scenario asks you to classify, decide which objective the loss event threatens before reaching for a level.

The same impact-graded logic extends from data to the things that hold it. Asset classification tags hardware, systems, software, and media by the sensitivity of the data they process or store, or the criticality of the function they support, so a laptop that handles HIGH-confidentiality data inherits that sensitivity and earns the corresponding controls. Classification of information and classification of assets are the same mental model applied to two object types; the asset usually inherits its grade from the data on it.

This section covers the governance of classification: who makes the call and what menu of labels they choose from. It assumes the proportionality idea from the previous section.

The data owner classifies; accountability is not delegable

Classification is a business decision made by the information (data) owner (a senior person in the business unit that creates or is responsible for the data), not by IT, security operations, or the custodian who stores and protects it. The owner determines the classification level and the protection requirements; the custodian implements those requirements (applies the encryption, runs the backups, enforces the access rules). The line between them is the most-tested distinction in this domain.

The reason the line matters is a governance rule that holds across the whole CISSP body of knowledge: you can delegate the responsibility to perform work, but you cannot delegate accountability. Even when handling is outsourced to a cloud provider or a managed-service custodian, the owner remains accountable for the label and for whether the data is adequately protected. So in a scenario, the actor who "determines the classification," "approves a change in classification," or "authorizes declassification" is always the owner, never the custodian, and never the security team acting on its own.

Government and commercial schemes

The labels differ by sector, but every scheme grades by the magnitude of harm from compromise, so learn each tier by its impact definition rather than its name. The diagram above stacks both schemes' tiers from most to least sensitive.

The U.S. government national-security scheme has four levels. The three classified tiers are defined by the damage to national security that unauthorized disclosure could reasonably be expected to cause, per Executive Order 13526 Sec. 1.2^[2]:

Tier	Damage standard on unauthorized disclosure
Top Secret	exceptionally grave damage to national security
Secret	serious damage to national security
Confidential	damage to national security
Unclassified	not a classified level; no damage standard applies

Note the predictable trap: "Confidential" is the lowest of the three government classified tiers, even though in everyday commercial usage "confidential" sounds like the most sensitive thing on the table. The word means different things in the two schemes.

A common commercial scheme uses four tiers graded by business impact: Confidential (most sensitive; serious harm to the organization if disclosed), Private (internal personnel or financial data, for use within the organization), Sensitive (harm if disclosed or altered; above public but below private), and Public (disclosure causes no harm). Other organizations use Restricted / Internal / Public, or a numeric scale; the number of levels is a policy choice. What is constant is the structure: each level is a band of expected harm, and the policy must define handling rules for each band so the label is actionable. A label with no associated handling requirement protects nothing.

This section is the mechanics of how a federal owner produces a classification, using the two NIST documents the exam expects you to attribute correctly. It assumes the owner-classifies rule and the impact-level idea from the previous sections.

In the federal model, classification is called security categorization and follows a documented method rather than a judgment call. The owner identifies the information type, looks up its provisional impact, confirms it, and rolls up to a system-level rating. The diagram above walks the four moves.

Step 1: identify the information type. NIST SP 800-60 Volume 1^[3] is the Guide for Mapping Types of Information and Information Systems to Security Categories; it catalogs information types (for example privacy, financial, investigative) and is what an owner consults to find the type their data belongs to.

Step 2: assign a provisional impact to each objective. SP 800-60 provides a recommended provisional confidentiality, integrity, and availability impact for each information type, which the owner then adjusts to the organization's actual context. The meaning of each level is fixed by FIPS 199:

• LOW: loss could be expected to have a limited adverse effect on operations, assets, or individuals.
• MODERATE: loss could be expected to have a serious adverse effect.
• HIGH: loss could be expected to have a severe or catastrophic adverse effect (e.g., loss of one or more primary functions, major financial loss, or loss of life).

Step 3: express the security category (SC). FIPS 199^[1] records the result in a fixed notation:

SC information type = {(confidentiality, impact), (integrity, impact), (availability, impact)}

For an information type, an objective may be NOT APPLICABLE (only confidentiality may be NA, for example, public information has no confidentiality requirement). Example from FIPS 199: investigative information categorizes as {(confidentiality, HIGH), (integrity, MODERATE), (availability, MODERATE)}.

Step 4: roll up to the information system (the high-water mark). A system usually holds several information types. Its category takes, for each objective independently, the highest impact among all resident types: the high-water mark defined by FIPS 199. So a system holding one MODERATE-confidentiality type and one LOW-confidentiality type is categorized HIGH-water at MODERATE for confidentiality. At the system level no objective may be NOT APPLICABLE and the minimum is LOW (the low-water mark for a system), because the system itself must always protect its own processing functions. The system's resulting categorization is the input that drives the control baseline selected afterward (in NIST's RMF, the next step is Select controls from SP 800-53). Categorize first: almost every later safeguard decision depends on this label.

This section names the question shapes this subtopic produces and the answer logic, so you can recognize them under time pressure. It assumes the owner/custodian split and the impact model from the earlier sections.

Pattern 1: "Who classifies?" / "What is the FIRST step in protecting new data?" The stem describes a new dataset, a reclassification request, or a dispute about a label. The right answer is the data owner (or "classify the data" / "determine its sensitivity"). Distractors offer the custodian, the security administrator, or a control like encryption. They are wrong because the owner holds the non-delegable accountability for the label, and because you cannot rationally select a control before you know the classification: categorization precedes protection.

Pattern 2: "Confidential" means different things. A government-context stem lists Top Secret, Secret, Confidential, Unclassified and asks which is least/most sensitive among the classified levels. The trap is that Confidential is the lowest classified tier ("damage"), below Secret ("serious damage") and Top Secret ("exceptionally grave damage"). In a commercial scheme, by contrast, "Confidential" is often the most sensitive tier. Read which scheme the stem is in before ranking.

Pattern 3: sensitivity vs. criticality. The stem describes data that is, say, public but mission-essential, and asks for its protection priority or which objective dominates. Map disclosure/modification harm to sensitivity (confidentiality/integrity) and unavailability harm to criticality (availability). The trap is treating "not sensitive" as "not important": a low-sensitivity, high-criticality asset still needs strong availability controls.

Pattern 4: high-water mark. The stem gives a system holding two or more information types with different C/I/A impact ratings and asks for the system's categorization. Take the highest rating in each objective independently across all types (FIPS 199 high-water mark): do not average, and do not pick a single "overall" type. The trap answers either average the levels or apply one type's whole SC to the system.

Pattern 5: attribute the NIST document. The stem asks which publication defines the impact levels (answer: FIPS 199) versus which one maps information types to provisional categories (answer: SP 800-60). The trap swaps them, or offers SP 800-53, which is the control catalog selected after categorization, not the categorization method itself.