Asset Security · Topic 1 of 3
Classification and Handling
Identifying and classifying information and assets, government and commercial classification levels, marking and labeling, and handling rules for each level.
- 3 min
- Classify by value, sensitivity, impact and legal requirements.
- Owners classify; custodians implement; users follow.
- Marking is human-readable; labeling is often machine-readable.
What it is
Classification assigns information and assets a level based on their value and the harm their loss would cause. Handling requirements then say how each level must be marked, stored, transmitted, shared and destroyed. Without classification, organizations either overprotect everything or underprotect what matters.
How it works
Classification schemes
| Government (example) | Commercial (example) |
|---|---|
| Top Secret | Confidential / Restricted |
| Secret | Private |
| Confidential | Sensitive / Internal |
| Unclassified | Public |
Exact names vary by organization; what matters is that each level has clear criteria and handling rules. Most organizations use three to five levels: too many become hard to apply.
Classification criteria
- Value to the organization and to competitors.
- Impact of disclosure, alteration or loss (legal, financial, reputational, safety).
- Legal and regulatory requirements (personal data, health data, card data).
- Age and usefulness: classification can change over time (declassification).
The data owner classifies; custodians and users apply the handling rules.
Data classification process
- Build an inventory of information and assets.
- Define levels and criteria in policy.
- Owners classify their data.
- Mark and label (documents, files, media, systems).
- Apply controls per level.
- Review classification periodically and when circumstances change.
Marking and labeling
| Term | Meaning |
|---|---|
| Marking | Human-readable indication on the information (headers, footers, banners) |
| Labeling | Attached to media or systems, often machine-readable (metadata tags) |
Labels let systems such as DLP tools enforce rules automatically.
Handling requirements by level
Handling rules cover storage (encrypted, locked), transmission (encrypted channels, approved methods), access (need to know), sharing (approval, NDAs), printing and copying, and destruction. Higher levels need stronger controls and more approvals.
A derived copy, extract or report keeps the classification of its source data unless the owner formally reclassifies it. Copying Restricted data into a dashboard does not make it Internal.
Unlabeled data
When data is found without a label and owners need time to review it, handle it under the organization's default classification until they decide. Guessing from the server or folder it sits in is unreliable.
Asset classification
Physical assets (laptops, servers, media) take the classification of the most sensitive data they hold or process.
How the exam asks about this
- "Who decides the classification of a data set?" The data owner.
- "A reporting extract of Restricted data has weaker controls." Carry over the source classification and name an owner.
- "Thousands of unlabeled files, owners need weeks." Apply the default classification and its handling rules meanwhile.
What to remember for the exam
- Classify by value, sensitivity, impact and legal requirements.
- Owners classify; custodians implement; users follow.
- Marking is human-readable; labeling is often machine-readable.
- Copies and extracts keep the source classification.
- Assets take the level of the most sensitive data they hold.
Classifying everything at the highest level wastes money and leads people to ignore labels. Classify accurately.
Common mistakes
Letting IT classify business data.
Downgrading derived data without the owner's decision.
Never reviewing classifications as data ages.
Check yourself
Who is responsible for classifying data?
The data owner.
What classification should a report built from Restricted data have?
The same Restricted classification, unless the owner formally reclassifies it.
What is the difference between marking and labeling?
Marking is human-readable on the information; labeling is attached to media or systems and often machine-readable.
Topic 1 of 3 in Asset Security
Test yourself on Asset Security
The full ISC2 CISSP question bank has 1,113 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISC2. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.