Member Resources-APPENDIX B - Data Classification and Handling Guidelines

APPENDIX B - Data Classification and Handling Guidelines

Pdf Summary

Oakleaf’s guidelines define four information classifications, with handling safeguards proportional to sensitivity:

- <strong>Restricted:</strong> The most sensitive information, often subject to legal or contractual requirements. Examples include client personal or non-public information (PII/NPI), health information, identification and financial account numbers, and protected documents. Unauthorized disclosure could cause significant harm.
- <strong>Confidential:</strong> Highly valuable, sensitive business information, including employee PII/NPI, accounting, payroll, and financial data. Disclosure could cause moderate harm.
- <strong>Private:</strong> Oakleaf- or third-party-owned information that may be shared only with people who have a business need. It is not for public release.
- <strong>Public:</strong> Information approved for general release, with no expected harm from disclosure.

Information created or received through work is <strong>Private by default</strong>. When data of different sensitivity levels are combined, the whole asset takes the highest classification. Restricted, Confidential, and Private information must not be made public; third-party sharing requires a business need and suitable safeguards. Information must not be moved to a format or medium with weaker protections. The CEO and CISO may approve exceptions.

Controls are strictest for Restricted data: encryption and access controls are required; mobile-device and cloud storage are prohibited; transmission must use encrypted email or SFTP; instant messaging, FTP, and faxing are prohibited. Printing requires business justification and senior approval, while copying is prohibited. Confidential data also requires encryption at rest and for external transmission, and cannot be stored on mobile devices; secure cloud storage is permitted. Private data generally has fewer mandatory controls, though encryption is often recommended. Public data has few restrictions.

The guidelines also specify rules for printing, disposal, labeling, physical mail, and third-party access. Examples of sensitive data include identity and financial details, employee medical and compensation records, credentials and cryptographic keys, internal network information, and strategic financial or merger information. Client-specific security requirements must also be followed.

Keywords

information classification

Restricted data

Confidential data

Private information

Public information

data handling safeguards

encryption requirements

access controls

third-party access

sensitive data