Skip to content

Data Classification

What is Data Classification?

The process of categorising data based on its sensitivity and the impact of unauthorised disclosure. Common levels: Public, Internal, Confidential, Restricted.

Information Security

Related terms

Information Security

Frameworks that govern data classification

ISO 27001:2022View framework →NIST Cybersecurity Framework 2.0View framework →CIS Controls v8View framework →

What the standards actually require on data classification

Requirements naming data classification across 6 standards, quoted from the control text.

ISMAP (Japan)3 controls

ISMAP Data Protection establishes comprehensive data lifecycle controls. (1) Data Classification: customer government data must be classified per Japanese government data classification scheme + including (a) General + (b) Sensitive + (c) Confidential + (d) St...

ISMAP-DataProtection-Classification-Encryption-DataResidencyJapan-Backup-SecureDeletion-Cryptography-FIPS · ISMAP Data Protection - Data Classification + AES-256 Encryption At Rest + TLS 1.3 In Transit + Data Residency Japan + Backup + Secure Deletion + Cryptography per FIPS 140-3 + CRYPTREC + KMS HSM →
Singapore Government Instruction Manual on ICT&SS Management (IM8)3 controls

Agencies must classify data according to sensitivity levels and apply appropriate handling and protection measures.

IM8-DAT.1 · Data Classification →
AWS Well-Architected Security Pillar2 controls

Understand and document the classification scheme that applies to the data the workload processes, including handling requirements, storage locations, owners and the legal obligations attached to each class.

SEC07-BP01 · Understand your data classification scheme →
South Korea Cloud Security Assurance Program (CSAP)2 controls

Customer data shall be classified according to sensitivity, with handling, storage, and transmission controls matched to classification, and government customer data treated with the highest level of protection.

CSAP-DATA-14 · Data classification and protection →
BSIMM1 control

Attack Models. A data classification scheme and inventory are created so the most important data and systems can be protected appropriately.

AM1.2 · Create a data classification scheme and inventory →
Bermuda Monetary Authority (BMA) Cyber Risk Management Code of Conduct1 control

Data Classification and Security. Information must be classified and protected commensurate with its sensitivity, and data classified as non-public must be protected by an appropriate level of security (paras 48, 52, 54).

BMA-18 · Data Classification and Security →

Questions people ask about data classification

What is Data Classification?
The process of categorising data based on its sensitivity and the impact of unauthorised disclosure. Common levels: Public, Internal, Confidential, Restricted.
Why is Data Classification important for compliance?
Data Classification is a key concept in Information Security. Understanding data classification helps organizations meet regulatory requirements, reduce risk, and demonstrate due diligence during audits. Our compliance platform maps 686 frameworks with 311K cross-framework control mappings.
What concepts are related to Data Classification?
Key concepts related to Data Classification include Information Security. Understanding these interconnected concepts provides a more comprehensive view of Information Security requirements and helps organizations build holistic compliance programs.
Which compliance frameworks address Data Classification?
Data Classification appears in the requirement text of ISMAP (Japan), Singapore Government Instruction Manual on ICT&SS Management (IM8), AWS Well-Architected Security Pillar, South Korea Cloud Security Assurance Program (CSAP), BSIMM. Across these standards we have identified 12 controls that name it directly, each linked to the control text on the compliance platform.
Where can I learn more about Data Classification?
Explore our compliance framework pages to see how data classification applies across different standards and regulations. Our implementation guides provide step-by-step guidance, and the compliance platform offers AI-powered analysis of how this concept maps across 686 frameworks.

See how Data Classification applies across compliance frameworks

Our platform maps 686 frameworks with 311K cross-framework control mappings. Explore how this concept is addressed across standards.

Explore on Platform
Written and maintained by Gerard Blokdyk, The Art of Service.