5.3.3. Sensitivity Labels and Sensitivity Label Policies
💡 First Principle: A sensitivity label is a persistent tag applied to content that can enforce protection — encryption, access restrictions, visual markings like a watermark or header — and because the label travels with the file itself, protection persists even after the file is downloaded, emailed, or moved outside its original location.
Sensitivity label policies control which labels are available to which users, whether a label is applied automatically (based on classification, 5.3.1) or left to the user's judgment, and whether justification is required to remove or downgrade a label — turning individual labels into a governed, organization-wide system rather than an ad hoc, per-document decision.
⚠️ Exam Trap: Sensitivity labels control protection and access to content — they do not control how long that content is retained or when it's deleted; that's the job of retention labels (5.3.6), a commonly confused but distinct capability.
Reflection Question: An employee emails a sensitivity-labeled confidential document to an external partner. Does the label's protection (like encryption or access restriction) still apply once the file leaves the company's systems? Why?
