Security · Zero Trust & Secure Architecture · 08
Data classification and access governance
Data classification and access governance establishes what data the organization holds, how sensitive each class is, where it lives, who may access it and how that access is granted, reviewed and removed. It is needed when access to sensitive data is granted by habit rather than by rule, when a regulation or contract requires defined handling for specific data, when a customer asks how their data is protected, or when a data incident revealed that nobody knew where the data was. The work produces a classification scheme the organization can actually apply, an inventory of sensitive data locations, access rules per class, the technical controls that enforce them where feasible, and the review cycle that keeps access aligned with need.
Scope
What the review covers.
- Classification scheme with a small number of usable classes
- Discovery and inventory of sensitive data across systems and storage
- Handling rules per class: access, storage, transfer, retention
- Access governance: ownership, approval, review and removal
- Technical enforcement: labeling, access control, loss prevention where justified
- Evidence for regulators, customers and auditors
Deliverables
What you receive.
| Deliverable | Form |
|---|---|
| Classification scheme and policy | Classes, criteria and handling rules |
| Sensitive data inventory | Where each class lives, with owners |
| Access governance procedure | Grant, review and removal with records |
| Enforcement design | Technical controls and where they apply |
Prerequisites
What we need from you.
- Access to file, collaboration, database and cloud storage platforms for discovery
- Data owners who can confirm classification and need
- The regulations and contracts that define handling obligations
Related
Where this sits.
By David Selakovic · Published 2026-10-16 · Revised 2026-10-16 · Reviewed every 180 days
Questions
Asked before engaging.
How many classes should we have?
As few as staff can apply correctly. Three or four is typical. Schemes with many classes are not used.
Do you deploy data loss prevention tools?
Where the risk justifies them and the organization can operate them. Classification and access governance come first.
How does this relate to privacy and data governance?
Closely. Privacy obligations define what personal data requires; this work makes those requirements real in systems. See Privacy and data governance.