# Data Classification Standard

## Purpose

This standard provides the handling requirements for data based on their classification.

## Scope

This standard applies to all Uncanny Software employees.

## Standard Statement

NIST Special Publication 800-88, “Guidelines for Media Sanitization”, defines the terms and methods for sanitizing hard drives and other media.

### SENSITIVE

| Data types (examples only)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             | Handling Requirements                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
| ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| <p>- Social Security number, full and truncated;<br>- Driver's license and other government identification numbers;<br>- Background check reports<br>- Biometrics<br>- Financial information, medical information, disability information;<br>- Law enforcement information, employment information, educational information, and military records;<br>- Merger and acquisition documents<br>- Corporate level strategic plans<br>- Vulnerability assessment reports<br>- Pending merger, acquisition or divestiture plans<br>- Credit cards or debit card numbers</p> | <p>- Secure email via PGP encryption, or TLS with file-level encryption for information sent<br>- Communicate file-level encrypted information via VPN, SSH, or SFTP protocols<br>- Mail information via registered mail service provider, and request tracking number<br>- Print only when necessary and cross-cut shred the hardcopy when no longer needed<br>- Do not store information on removable media, or fax without a proper cover sheet<br>- Ensure applications used have TLS for data in transit<br>- Scanned documents must be secured<br>- Access to information must be restricted to authorized individual. NDA must be in place in order to disclose the information</p> |

### CONFIDENTIAL

| Data types (examples)                                                                                                                                                                                                                                                                                                                                                                                                          | Handling Requirements                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
| ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| <p>- Employee performance evaluations<br>- Customer transaction data<br>- Strategic alliance agreements<br>- Computer passwords<br>- Internal audit reports<br>- Regulatory exam reports<br>- Business unit strategic operating plans or budgets<br>- Business Continuity plan and Disaster Recovery Plans<br>- Customer contracts<br>- Voicemail messages<br>- Encryptions keys or passwords<br>- Network design document</p> | <p>- Secure email with TLS<br>- Consider using file-level encryption for information sent<br>- Communicate information via VPN, SSH, or SFTP protocols<br>- Mail information via an approved provider<br>- Print only when necessary and cross-cut shred the hardcopy when no longer needed<br>- Do not store on removable media<br>- Ensure applications used have TLS for data in transit<br>- Scanned documents must be secured<br>- Access to information must be restricted to authorized individual. NDA must be in place for disclosing the information</p> |

### PRIVATE

| Data types (examples)                                                                                                                                                                | Handling Requirements                                                                                                                                                                                                                                                                               |
| ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| <p>- Employee training materials<br>- Application source codes<br>- Internal policy manuals<br>- Reports, or working papers<br>- Company demographics<br>- Equipment inventories</p> | <p>- Secure email with TLS<br>- Communicate information via SSH or SFTP protocols<br>- Ensure applications used have TLS for data in transit<br>- Access to information is generally unrestricted for individuals within the company. Information must not be accessible to the general public.</p> |

### PUBLIC

| Data types (examples)                                                                                         | Handling Requirements                                                                                                                                                             |
| ------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| <p>- Product and service brochures<br>- Advertisements<br>- Job opening announcements<br>- Press Releases</p> | <p>- Secure email with TLS<br>- Access to information is generally unrestricted for individuals within the company. Information must not be accessible to the general public.</p> |

## Violations

Any violation of this standard may result in disciplinary action, up to and including termination of employment.

Any employee or partner who is requested to undertake an activity which he or she believes is in violation of this standard, must provide a written or verbal complaint to his or her manager, any other manager or the Human Resources Department as soon as possible.

## References

ISO/IEC 27002:2013 - 8.2.1 Classification of Information ISO/IEC 27002:2013 - 8.2.2 Labeling of Information

## Related Documents

* [Information Classification Policy](https://uncanny-software.gitbook.io/content-library/infosec-policies/isp03-information-classification)

## Revision History

* [Document history via Github](https://github.com/theaccordance/uncanny-software/commits/main/docs/infosec-policies/ISP08-Data-Classification-Standard.md)
