How do we classify information without everything ending up "Confidential"?

Start

New or changed information needs a level

Classification fails in two ways: nothing is labelled, so everyone decides for themselves, or everything is Confidential, so the label stops meaning anything. The cure is one decision by an owner, made from the harm the information could do. Classify it before it is first used, shared or retained, and name every system, site and regular export that holds it: a system or medium takes the highest level of the information it holds.

• Then: Does the information have a named owner?

Decision

Does the information have a named owner?

The owner is the manager accountable for the information, recorded as a role, never a team or a committee. The owner decides its level, who may access it, how long it is kept and whether it is released. IT and the security role advise on a level; the owner decides it. The custodian, often IT or a supplier, applies the handling the level requires.

• Yes: Rate confidentiality, integrity and availability
• No, or not known: Hold it as Internal while an interim owner is named

Step

Hold it as Internal while an interim owner is named

Where an asset has no owner, the Head of Information Security names the head of the function it serves as owner until a decision is recorded. The information is handled as Internal meanwhile. Where an owner leaves, the owner's line manager owns the asset until a new owner is recorded, and the asset keeps its level.

• Then: Rate confidentiality, integrity and availability

Step

Rate confidentiality, integrity and availability

Ask what harm would follow if the wrong person saw it, if it were changed without authority or wrong, and if it could not be used when needed. Judge each against every area of the risk scale (financial, service, data, legal and regulatory, reputation) and take the worst. Low is the risk scale's Minor, Medium is Moderate, and High is Major or Severe, so a classification and a risk assessment judge harm alike. Rate it as it is, before its controls: a payroll file is High for confidentiality even in an encrypted system.

• Then: Has the owner rated all three impacts?

Decision

Has the owner rated all three impacts?

This is the first question of the pack's decision. If any rating is missing, the decision is incomplete and the register shows the asset as awaiting the owner's decision. The pack holds it at Internal meanwhile, rather than guessing in either direction.

• Yes: Does it, or an export of it, combine many records?
• No, or not yet: Handle it as Internal until the owner decides

Outcome

Handle it as Internal until the owner decides

Information whose classification is incomplete, and business information without a label, is handled as Internal. A missing label never makes it Public. If it is obviously more sensitive, such as personal data at scale or prices, treat it as Confidential, ask the owner, and report it if it was found in the wrong place. Ask the owner to rate it: classification is due before the information is first used, shared or retained.

• Then: Rate confidentiality, integrity and availability (back to an earlier step)

Decision

Does it, or an export of it, combine many records?

A collection, export or report takes the highest level of anything in it, and a higher level where combining the items raises the harm. Ask whether it puts many customers', staff members' or suppliers' records in one place; joins two harmless kinds of information, such as names with absence reasons; would be worth more whole than in parts to a competitor or fraudster; or is copied out of its system into a report or spreadsheet. The combination is usually what leaks.

• Yes, or not sure: Rate the combination on its own and keep the higher rating
• No: Is there special category data, or personal data at scale?

Step

Rate the combination on its own and keep the higher rating

Rate each regular export or collection as a whole, area by area, and keep the higher of the part and the whole for each of the three impacts. In the pack's example, one customer's price list was rated Medium, because it goes to that customer. Every customer's prices in one file would let a competitor undercut every bid, so the export was re-rated Confidential. Record each export in the register as part of the asset or as an asset of its own.

• Then: Is there special category data, or personal data at scale?

Decision

Is there special category data, or personal data at scale?

Special category data, such as health, ethnic origin, religious belief or trade union membership, and personal or customer data at scale are always Confidential. The risk scale rates personal or customer data at scale Severe in its Data area, and the pack treats special category data the same, whatever the other ratings say. If you cannot tell whether it holds such data, take the Confidential branch and ask the Data Protection Officer, who is consulted on every special category asset.

• Yes, or not known: Confidential: restricted to named roles or recipients
• No: Is any of the three impacts High?

Decision

Is any of the three impacts High?

The level is the highest that any one of confidentiality, integrity or availability justifies, and no higher. One High is enough: supplier bank details harm no one if seen, but a changed bank detail diverts a payment run, so integrity alone makes them Confidential. Value is not harm. Information is not Confidential because it is important, took effort to produce or belongs to a senior person.

• Yes: Confidential: restricted to named roles or recipients
• No: Is every impact Low, and has the owner approved release?

Decision

Is every impact Low, and has the owner approved release?

Public is a decision, never a default. It needs every impact rated Low and the owner's recorded decision that the information may be given to anyone. Low harm alone is not enough: answers to common customer questions may harm no one if seen, but until the owner releases them they are Internal. A highest impact of Medium is Internal.

• Yes: all Low, and released: Public: only the version the owner released
• No, or not known: Internal: for the organisation and approved suppliers

Outcome

Confidential: restricted to named roles or recipients

Confidential is for material harm, and its rules are strict. Once the owner approves it, the custodian sets up a named, restricted location; access through approved role profiles, or non-standard access with an expiry; encryption at rest and on every route outside the managed systems; labels at the source; and the AI tools approved for it, or a record that there are none. A supplier holds it only under the contract clauses, after its assessment. The Head of Information Security checks each new Confidential setup.

• Then: The owner approves the level, records the reason, sets a review

Outcome

Internal: for the organisation and approved suppliers

Internal is the default level. Keep it in managed storage with access control, never in personal accounts or on unmanaged devices. Share it with colleagues who need it, and with approved suppliers and partners with a business need under a contract with confidentiality terms, checking the address before sending. Use only AI tools approved for Internal, signed in with the work account. Keep it under the business retention schedule and delete it securely.

• Then: The owner approves the level, records the reason, sets a review

Outcome

Public: only the version the owner released

The release makes the released version Public; the working files keep their own level. The release decision names the owner, the date and the version released. Keep the master copy in managed storage so the published copy can be checked and restored, and delete it when it is no longer needed.

• Then: The owner approves the level, records the reason, sets a review

Step

The owner approves the level, records the reason, sets a review

The reason is the harm that sets the level, never the information's value. The owner may choose a higher level than the ratings give, and records why; nobody chooses a lower one. If the owner and the Head of Information Security disagree, the higher level applies until the owner's line manager decides, and both views are recorded. The pack's default review is at least every 12 months, and within 15 working days of a material change.

• Then: Add the markers: Personal data, Special category, Legal hold

Step

Add the markers: Personal data, Special category, Legal hold

A marker adds the rules of a law or a duty to the level, and never lowers it. Personal data carries its marker at every level: data protection law (GDPR) applies regardless of the label, and the label does not decide whether processing is lawful. A shift rota with names is Internal with the marker. Special category data is open to named people only and never goes into an AI tool. Information under a legal hold is not changed, deleted or disposed of until Legal releases it in writing.

• Then: Label it on every medium and apply the handling rule

Step

Label it on every medium and apply the handling rule

The label is how the next person knows the level. Confidential is labelled always, on every page, file, message and copy; Internal wherever the medium supports it. Set labels at the source, so exports carry them without anyone remembering, and let copies, prints and meeting papers keep the level. The handling matrix sets the rule for each action, from storing and sharing to AI tools and disposal. A rule that cannot be met becomes a plan with a date the owner approves, or an exception.

• Then: Later, has something changed the harm?

Decision

Later, has something changed the harm?

Reclassify when a change in purpose, content, audience, incident or contract changes the impact. A bulk export, personal or special category data added, or an incident that shows the impact was underrated usually raises it. A release, an embargo date passing, anonymisation or a replaced price list usually lowers it. A new purpose, audience or supplier, or a change in law or contract, can go either way. Suspected mishandling or exposure is reported first.

• No: annual review: Confirm it at the annual review
• Raises it, or either way: Rate confidentiality, integrity and availability (back to an earlier step)
• Lowers it: Only the owner lowers it, with the reason and date
• Mishandled or exposed: Contain it, report it at once, then reassess

Outcome

Only the owner lowers it, with the reason and date

A lower level applies to the new version and its future copies; copies already shared keep their label until replaced. Confidential becomes Public only through a release decision. An anonymised version or statistics are rated on their own, and the source keeps its level. Plan the commonest lowerings when classifying: record the date and new level of a price list due to be announced, or a bid before its decision, so the change does not rely on memory.

Outcome

Contain it, report it at once, then reassess

Stop it going further: do not forward it, recall or unshare it if the system allows, and delete nothing. Report it at once through the incident reporting route, saying what was exposed, to whom, when, and its level. Nobody is blamed for a report made in good faith. Where personal data may be involved, the incident process decides whether it is a personal data breach. Once it is contained, the owner reassesses the asset and its copies.

• Then: Rate confidentiality, integrity and availability (back to an earlier step)

Outcome

Confirm it at the annual review

With no trigger, the owner confirms the level, owner, location, markers and retention at least every 12 months by the pack's default. Each quarter the Head of Information Security checks a sample of Confidential assets where they are actually held: who can reach them, how they are labelled and shared, and whether exports exist that the register does not show. The first check usually finds the export nobody listed.