Page History

3.1 Typically a number of "data classification levels" are identified by the institution.

Keep it as simple as possible - don't create any more levels than you have to. Each level should be differentiated from the other by the different actions required to appropriately handle the data.

Data Classification, Security, and Compliance: Helping Users Help Themselves (University of Michigan)

Higher Education

a. The levels are given appropriate names and definitions, and then each data element is classified into the proper level.

Universities differ on how many levels are defined, although the most common number is three, four, or five.

Use names that are very clear to users, for example, "restricted" and "sensitive" are very similar terms and would cause confusion if used for a medium and high level, respectively.

Keep the highest level very high, because this level will cost a lot to secure.
Examples (from lowest to highest level):
1) Public, Restricted, and Private
2) Public, Sensitive, and Confidential
3) Category III, Category II, and Category I
4) Public, Official Use Only, and Confidential
(Note that the word "public" used in data classification is defined differently than the word "public" used in the phrase "public records request" as used in state open records acts. )

University of Washington Privacy Brief: Data Classification

Higher Education

The Ohio State University Data Element Classification Assignments

Higher Education

Stanford Data Classification, Access, Transmittal, and Storage Guidelines and Chart

Higher Education

University of Texas at Austin Data Classification Policy

Higher Education

EDUCAUSE's Model Security Policy, Section 3.0, Asset Classification

EDUCAUSE

3.2 Check for state statutes that may already define some or all levels for you, and what words to use to describe the levels.

State guidelines will most likely apply to state schools.

Minnesota Government Data Practices Act

Government

3.3 Check for recognized standards that may already define some or all levels for you, and what words to use to describe the levels.

FIPS 199: Standards for Security Categorization of Federal Information and Information Systems

Government

3.4 Consider using Confidentiality, Integrity, and Availability (CIA) as criteria to classify data.

Presentation: Data Classification and Privacy: A Foundation for Compliance

Higher Education