Mini$-$Project: Data Classification

$2$ of $3$

ect Overview

Time Estimate: $1$ hour

Data classification is as fundamental a part of securing your organization's information as knowing what data you have and who can access it$.$ It's the process of identifying and assigning predetermined levels of sensitivity to different types of information. If your organization doesn't properly classify your data, then you cannot properly protect your data.

Instructions

You are working for a company that has the following data classification categories:

PUBLIC: Information that can be disclosed to anyone. Does not violate an individual's right to privacy. Does not expose the company to financial loss, embarrassment, compromise a competitive advantage or jeopardize the security of the company.

INTERNAL USE: Information is limited to company employees, contractors, and vendors covered by a Confidentiality or Non$-$Disclosure Agreement. If there is an unauthorized disclosure, compromise, or destruction of this information, there would be minimal or no significant impact to the company, its customers, or employees.

CONFIDENTIAL: Information intended for sole use within the company and$/$or between the company and the company's customers or Business Partners. Limited to "Need$-$to$-$Know". Information that may result in financial loss, damage to the company's reputation, loss of business, and potential legal action.

RESTRICTED: This classification applies to extremely sensitive and highly valued operational, financial, technical or personnel information. Unauthorized disclosure, alteration or destruction of this information would result in severe damage and could compromise the viability of the Company, its affiliates or its business partners, including loss of competitive advantage$/$position$,$ financial loss, damage to reputation, loss of business and potential legal action. Access to or release of this information must be restricted to those with an explicit, predetermined and stringent business need. Authorization for access to information with this classification should always be obtained from the information owner. Reproduction or forwarding of information with this classification should not be done without the information owner's authorization.

Based on the above categories and descriptions, select the category that is MOST appropriate for the example given.

Customer information

Encryption keys

Organizational chart

Network diagrams

Employee medical records

Marketing brochures

Employee handbook

Merger and acquisition plans

Financial results prior to certification and release

Interoffice memos

Intellectual property $/$ trade secrets

Press releases