Study Guide-APPENDIX B - Data Classification and Handling Guidelines

APPENDIX B - Data Classification and Handling Guidelines

Pdf Summary

Oakleaf’s Data Classification and Handling Guidelines define how employees must protect information using a four-level scheme: <strong>Restricted, Confidential, Private, and Public</strong>. <strong>Private</strong> is the default for information created or received in the course of work unless it requires higher protection or is approved for public release. When datasets are combined, the <strong>most restrictive classification</strong> applies to the entire system. Restricted/Confidential/Private data must never be released publicly, but may be shared with third parties only for a business need and with required controls. Data may not be moved to a new format or medium unless equivalent security controls exist. Exceptions require <strong>CEO and CISO</strong> approval.

<strong>Restricted</strong> is the most sensitive, typically driven by legal/contractual requirements (e.g., client loan-file NPI/PII). Unauthorized disclosure would cause <strong>significant damage</strong> (regulatory/contract violations, reputational harm, lawsuits). Controls include <strong>encryption at rest and in transit</strong>, strict logical/physical access controls, <strong>no mobile device storage</strong>, <strong>no cloud storage</strong>, no IM/FTP (SFTP allowed), encrypted email, limits on printing (senior management approval), no copying, no faxing, certified/tamper-resistant mail, shredding, labeling requirements, and <strong>CEO/Managing Director approval + NDA</strong> for third-party release.

<strong>Confidential</strong> is internally designated sensitive business information (e.g., employee PII/NPI, accounting/payroll/financial). Loss causes <strong>moderate damage</strong>. Controls largely mirror Restricted (encryption required; no mobile storage; secure cloud allowed; encrypted external transmission via SFTP/encrypted email; no fax; controlled printing/copying; shredding; labeling; owner approval and recommended NDA for third parties).

<strong>Private</strong> is non-public company or entrusted information with limited impact if exposed; sharing is limited to those with a business need. Encryption is recommended (including mobile with remote wipe where possible); external encryption recommended; IM/FTP prohibited.

<strong>Public</strong> information is freely shareable with no special handling.

The document also defines <strong>NPI/PII</strong> elements (name plus SSN, passport, driver’s license, financial account numbers, ePHI, etc.) and provides classification examples across client data, employee data, infrastructure credentials/keys, and financial/legal/strategy information.

Keywords

data classification

information handling guidelines

Restricted data

Confidential data

Private data default

Public information

PII NPI ePHI

encryption at rest and in transit

third-party data sharing controls

CEO CISO approval exceptions