Lion Cipher Lab

Build a data classification scheme

• GRC / Compliance
• Intermediate
• ~45 min
• Free · no account required

Why it matters

Almost every security and privacy control you will ever meet secretly depends on one question that most organizations have never actually answered: how sensitive is this piece of data? You cannot decide who may see a file, whether it can leave the building, how long to keep it, or how hard to encrypt it until you have SORTED your data by sensitivity — and 'sort your data by sensitivity' is exactly what a data classification scheme is. It is the small, boring, foundational artifact that makes every downstream control decidable: with it, 'can this be emailed to a vendor?' has a deterministic…

What you'll learn

• explaining in plain words what data classification is: sorting your information into a few named sensitivity TIERS so that how you protect each piece follows automatically from its label
• defining the vocabulary cold — data at rest vs data in transit, PII, the regulated categories (PII / PHI / PCI), data owner vs data custodian, a handling requirement, a data inventory
• choosing a small, defensible tier model (Public / Internal / Confidential / Restricted) and saying why four tiers beats twelve — over-classification is a real failure mode that kills the scheme
• writing a HANDLING MATRIX: for each tier, who may access it and exactly how it must be stored, transmitted, retained and destroyed, plus how it is labelled
• actually DOING the classification: assigning a tier to every item in a provided sample dataset (marketing copy, source code, HR records, customer PII, card data, financials) instead of only reading about it
• building a simple data inventory / data-flow map (a RoPA-adjacent artifact): what data you hold, its tier, who owns it, where it lives and where it flows
• making handling deterministic: turning 'can we email this out?' from a shrug into a yes/no you can read straight off the label
• judgment: the cost of over- AND under-classification, aligning your tiers to a recognized model (FIPS 199 / NIST SP 800-60), and the hard truth that a scheme on paper changes nothing until it is ENFORCED with access controls, labels and DLP

Steps in this lab

1. From zero: what data classification is, and the words it runs on
2. Meet the sample company and the twelve data items you will classify
3. Choose your tier model — four tiers, and why not twelve
4. Write the handling matrix — the rules that make a label mean something
5. Now DO it: classify all twelve sample items
6. Build the data inventory / data-flow map
7. The measurement: make 'can this be emailed externally?' deterministic
8. The honest negative: a scheme on paper changes nothing
9. Judgment: what to keep, and the mistakes that kill schemes

Open the full interactive lab →