Classification schemes and labelling in Canada and in business

Classification is the process of deciding how sensitive or critical an asset is and placing it in a category that carries a defined set of protections. It is the bridge between knowing what you have, the subject of lesson 1, and knowing how to handle it, the subject of lesson 4. A good scheme lets thousands of people make consistent decisions without consulting the security team each time: if a document is marked confidential, everyone knows it must not be emailed outside the company unencrypted, left on a printer or posted in a public channel. This lesson covers why classification matters, how government and commercial schemes differ, how to choose the right number of levels, and how labelling and marking make classification visible.

Why classify

Without classification, organizations tend to fall into one of two failure modes. Either they protect everything at the highest level, which is expensive, slows work down and leads people to find workarounds, or they protect everything at a low level, which leaves the most sensitive information exposed. Classification lets protection be proportionate: strong controls where the harm from compromise is high, lighter controls where it is low. It also supports legal compliance, because many laws attach obligations to particular categories of data such as personal health information or payment card data, and it gives incident responders a quick way to judge how serious a loss is.

Classification normally considers the harm from compromise of each of the core properties. Confidentiality asks how much damage unauthorized disclosure would cause. Integrity asks how much damage unauthorized or accidental change would cause. Availability asks how much damage loss of access would cause, and for how long the organization could cope. Some schemes record a separate rating for each; others focus on confidentiality and handle availability through the business impact analysis. Either way, the classification decision should rest on harm, not on who created the information or how important the author feels.

Government classification

The Government of Canada uses a two-track scheme set out under the Policy on Government Security and the Directive on Security Management. Information whose compromise could reasonably be expected to cause injury to the national interest, meaning the defence and maintenance of the social, political and economic stability of Canada, is classified: Confidential (injury), Secret (serious injury) or Top Secret (exceptionally grave injury). Information whose compromise could cause injury outside the national interest, for example to an individual, an organization or a government program, is designated Protected: Protected A (injury, such as a person's date of birth or salary), Protected B (serious injury, such as medical records, most personal information in tax files and solicitor-client privilege) and Protected C (extremely grave injury, such as information whose release could lead to loss of life). Most federal personal information is Protected A or B. Contractors who handle such information need the appropriate security screening through the Contract Security Program.

Canadian classification decisions are guided by an injury test, and the Treasury Board Standard on Security Categorization asks institutions to consider the confidentiality, integrity and availability of information and assets. Contractors working on federal contracts receive a Security Requirements Check List that states which levels of information they will handle. Provincial governments have their own schemes; Ontario, for example, uses unclassified, low, medium and high sensitivity under its Information Security and Privacy Classification policy, and Alberta and British Columbia have comparable schemes for public bodies.

Commercial classification

Private organizations are free to design their own schemes, and most use three to five levels. A common four-level scheme is public, internal, confidential and restricted. Public information can be released to anyone without harm: published marketing material, press releases and public filings. Internal information is meant for employees and trusted partners, and disclosure would cause minor harm: the staff directory, internal policies and routine project notes. Confidential information would cause significant harm if disclosed: customer lists, contracts, unreleased financials, most personal information. Restricted information would cause severe harm: merger plans, trade secrets, encryption keys, authentication secrets and large sets of sensitive personal data. Other common names include sensitive, private and highly confidential; the names matter less than clear definitions.

The number of levels is a trade-off. Too few, and very different kinds of information end up with the same controls, so either the sensitive information is under-protected or the routine information is over-protected. Too many, and people cannot tell the levels apart, so they guess, usually by choosing the highest level to be safe, a problem called over-classification. Over-classification wastes money, obstructs sharing and erodes respect for the scheme. Most organizations find that three or four levels, plus special handling markings for particular categories such as personal information or payment card data, strike the right balance.

Government and commercial schemes differ in emphasis. Government schemes centre on the national interest and harm to the state, are backed by law and security clearances, and include formal declassification. Commercial schemes centre on harm to the business and its customers, are backed by policy and contract, and usually rely on periodic review rather than automatic declassification. Both share the same core idea: the category sets the controls, and the harm from compromise sets the category.

Making classification decisions

Classification starts with criteria that describe harm in concrete terms, so that two people looking at the same information reach the same answer. Good criteria combine the type of information, legal and contractual obligations, the volume involved and the context. A single customer's email address may be internal; a million email addresses with purchase histories are confidential or restricted, because aggregation increases harm. Combining individually low-value pieces of information to reveal something sensitive is called the aggregation problem, and the related inference problem arises when someone deduces sensitive facts from less sensitive ones, such as inferring a merger from unusual travel and legal bills.

Classification is not permanent. Information should be reviewed when circumstances change: a product launch makes design details public, a contract ends, a legal hold is lifted, or the data is anonymized. The owner should set review points, and the scheme should allow downgrading as well as upgrading. Government schemes handle this through declassification rules; commercial schemes should build reviews into records management, covered in lesson 9.

Labelling and marking

A classification decision is only useful if people and systems can see it. Marking is the human-readable indication of classification on the information itself: a header and footer on a document, a banner on a screen, a stamp on a printed page or a sticker on a removable drive. Labelling usually refers to machine-readable attributes attached to the information, such as metadata in a file, a tag on a cloud storage object or a sensitivity label in an email system, which tools such as data loss prevention can act on. Many sources use the two terms loosely; the important distinction is between what people read and what systems read, and a mature program uses both.

Modern office suites and cloud platforms support sensitivity labels that can be applied manually, recommended automatically based on content, or applied automatically by policy. A label can trigger protections: encryption, watermarks, restrictions on forwarding or printing, and blocking upload to unapproved services. Automatic labelling reduces reliance on users remembering, but it can mislabel, so a common design is to recommend labels based on content and let users confirm or justify a change, with logging. Unlabelled information should have a default, and the safe default is usually internal rather than public.

Physical media and equipment need marking too. Backup tapes, removable drives and printed reports should carry their classification so that couriers, cleaners and disposal staff know how to handle them. Systems can be labelled with the highest classification of the data they process, which helps operators and auditors, though some organizations avoid conspicuous labels on equipment in public areas because a sticker saying restricted tells a thief exactly what to steal.

Classification across borders and partners

Organizations that share information with partners, suppliers or other governments need to map their levels to the other party's. A contract or information-sharing agreement should state how each level will be treated, so that a supplier does not treat a customer's restricted data as merely internal. The Traffic Light Protocol, version 2.0 published by FIRST in 2022, is a widely used simple scheme for sharing threat intelligence: TLP:RED (named recipients only), TLP:AMBER and TLP:AMBER+STRICT (limited sharing within organizations), TLP:GREEN (community sharing) and TLP:CLEAR (no restriction). It is a sharing protocol, not a full classification scheme, but it illustrates how agreed markings let different organizations handle information consistently.

Thinking like a manager

On the exam, classification questions often test who decides and on what basis. The owner classifies, using criteria based on harm and legal obligations, and the custodian implements the resulting controls. If a scenario describes inconsistent handling, the fix is usually clearer criteria, training and labelling tools rather than more technology alone. If a scenario describes over-classification slowing the business, the answer is to refine the scheme and criteria, not to abandon classification. And when information is combined, remember aggregation: the whole can be more sensitive than any of its parts.