data classification
termgovernance & risksecurity
Deciding which data is sensitive and how each class must be handled - the step every other data control depends on.
It fails in a specific way: a scheme with five levels that nobody applies is worse than two levels that everyone does, because controls keyed to labels do nothing when the labels are absent or wrong. The workable version is coarse, automatic where possible, and tied to a consequence people can see. If nothing behaves differently once something is labelled confidential, the exercise produced paperwork rather than protection.
Also known as: labelling