Insights · Field note · Security assurance and compliance
Data classification you can actually enforce
A five-level scheme with a forty-page handbook is never applied. Three levels, clear examples and technical enforcement where it counts.
Data classification works when staff can apply it without thinking and systems enforce it without asking. That means few levels, usually three, each with plain examples; regulated categories such as CUI, protected health information and privileged legal material mapped explicitly to a level with their specific handling rules; labels applied by default where possible and by people only where necessary; and technical enforcement of the rules that matter most, such as encryption, sharing restrictions and retention, for the top level. Elaborate schemes fail because nobody uses them; simple schemes fail only if nobody enforces them.
In detail
What the evidence shows.
Three levels and examples
Public: anything already published. Internal: ordinary business information. Restricted: anything whose exposure would harm a client, a person or the organization, including every regulated category. Each level needs a sentence of definition and a dozen concrete examples from the organization’s own work. Staff classify by recognizing examples, not by interpreting policy.
Regulated data mapped in
CUI, protected health information, cardholder data, privileged material and personal data each carry handling rules from law or contract. The scheme assigns each to a level and attaches the specific rules, so that the regulatory requirement becomes an application of the ordinary scheme rather than a separate program nobody follows.
Enforce what matters
Default labels by location: everything in the client matter folder is Restricted. Sharing restrictions, encryption and retention tied to the label in the platforms that support it. Access rules by classification. Monitoring for Restricted data leaving by email or upload. Enforcement makes the scheme real; training alone does not.
Keep it alive
Review the examples annually. Audit a sample of labels. Treat mislabeling as a process signal rather than a disciplinary one. NIST SP 800-171 requires marking and handling for CUI; the same scheme satisfies it. See data classification and access governance and the glossary entry for data classification.
By David Selakovic · Published 2026-10-16 · Revised 2026-10-16 · Reviewed every 180 days