Data classification

Data classification assigns each information asset a sensitivity label, such as public, internal, confidential, or secret, based on the impact its disclosure, alteration, or loss would cause. The data owner performs the classification, because only the business side can judge that impact. The label then dictates handling requirements across the data lifecycle: where it may be stored, how it must be encrypted, who may access it, how long it is retained, and how it is destroyed.

The direction of travel decides exam answers: classification drives control selection, never the reverse. You do not classify data as confidential because it happens to sit on an encrypted server; you encrypt the server because the data on it is confidential. Classification is also the economic engine of security: over-classifying wastes money protecting trivia, while under-classifying leaves crown jewels behind weak controls. Government schemes (top secret, secret, confidential) and commercial schemes (confidential, private, sensitive, public) differ in labels, not in logic.

Exam relevance: if a scenario asks what must happen before protection requirements or controls can be chosen, the answer is data classification. If it asks who classifies, the answer is the data owner. The nearest confusable is labelling in mandatory access control: MAC labels are the enforcement mechanism a system applies, while classification is the governance decision that produces the label in the first place.