3.1. Information and Asset Classification
💡 First Principle: Classification is the act of assigning a protection level to information or assets based on how much harm unauthorized disclosure, modification, or loss would cause. Without classification, every piece of data gets either too much protection (waste) or too little (breach). Classification makes protection proportional to risk.
Classification also creates legal and contractual clarity. An organization that processes EU personal data must classify it appropriately to trigger the correct GDPR controls. A defense contractor that handles Controlled Unclassified Information (CUI) must classify it to comply with DFARS. Classification is not just an internal governance tool — it creates external obligations.
Why this matters: Exam questions routinely ask who has the authority to classify, reclassify, or declassify data — and the answer is always the data owner (a business manager), not the security team or IT staff. The security team advises on classification criteria; business owners make the decisions.
⚠️ Common Misconception: Government classification levels (Top Secret / Secret / Confidential / Unclassified) apply only to government and defense contexts. Commercial organizations define their own schemes — there is no universal commercial standard, only common patterns. The exam tests both government and commercial models.
