Data Classification

Data residing on corporate systems must be continually evaluated and classified into the following categories:

1. Personal: includes user's personal data, emails, documents, etc. This policy excludes personal information, so no further guidelines apply.

2. Public: includes already-released marketing material, commonly known information, etc. There are no requirements for public information.

3. Operational: includes data for basic business operations, communications with vendors, employees, etc. (non-confidential).

4. Critical: any information deemed critical to business operations (often this data is operational or confidential as well). It is extremely important to identify critical data for security and backup purposes.

5. Confidential: any information deemed proprietary to the business. See the Confidential Data Policy for more detailed information about how to handle confidential data.

 

Data Storage

The following guidelines apply to storage of the different types of company data.

1. Personal: There are no requirements for personal information.

2. Public: There are no requirements for public information.

3. Operational: Operational data must be stored where the backup schedule is appropriate to the importance of the data, at the discretion of the user.

4. Critical: Critical data must be stored on a server that gets the most frequent backups (refer to the Backup Policy for additional information). System- or disk-level redundancy is required.

5. Confidential: Confidential information must be removed from desks, computer screens, and common areas unless it is currently in use. Physical copies of confidential information should be stored under lock and key (or keycard/keypad), with the key, keycard, or code secured.

 

Data Transmission

The following guidelines apply to transmission of the different types of company data.

1. Personal: There are no requirements for personal information.

2. Public: There are no requirements for public information.

3. Operational: No specific requirements apply to transmission of Operational Data, however, as a general rule, the data should not be transmitted unless necessary for business purposes.

4. Critical: There are no requirements on transmission of critical data, unless the data in question is also considered operational or confidential, in which case the applicable policy statements would apply.

5. Confidential: The guidelines for transmission of confidential data set forth in Section 4 of the Confidential Data Policy shall apply to all confidential information.

 

Data Destruction

The following guidelines apply to the destruction of the different types of company data.

1. Personal: There are no requirements for personal information.

2. Public: There are no requirements for public information.

3. Operational: Cross-cut shredding is required for documents. Storage media should be appropriately sanitized/wiped or destroyed.

4. Critical: There are no requirements for the destruction of Critical Data, though shredding is encouraged. If the data in question is also considered operational or confidential, the applicable policy statements would apply.

5. Confidential: Confidential data must be destroyed in a manner that makes recovery of the information impossible. The guidelines for data destruction set forth in Section 4 of the Confidential Data Policy shall apply to all confidential data. 

 

Applicability of Other Policies

This document is part of the company's cohesive set of security policies. Other policies may apply to the topics covered in this document and as such the applicable policies should be reviewed as needed.