Lion Cipher Lab
Classify and handle data by sensitivity
- GRC / Compliance
- Beginner
- ~50 min
- Free · no account required
Why it matters
Almost every security rule an organization has -- who may see a file, whether it can be emailed, how long it is kept, how it is destroyed -- is really a rule about data, and it only makes sense once you have sorted your data by how sensitive it is. Data classification is that sorting step: you put every kind of information you hold into a small number of sensitivity levels, and then a level, not a guess, decides how each thing must be stored, shared, encrypted, retained, and disposed of. It is one of the most foundational and reused artifacts in governance, risk, and compliance (GRC) work,…
What you'll learn
- what data classification is and why it exists
- the four classic sensitivity levels (Public / Internal / Confidential / Restricted)
- what sensitivity means (the harm if data is exposed)
- what PII is and why it raises a data type's level
- inventorying your real data types
- data at rest vs data in transit
- what encryption does for stored and shared data
- building a handling matrix (storage, sharing, encryption, retention, disposal)
- data retention and secure disposal / media sanitization
- labelling data so the rules actually get followed
Steps in this lab
- What data classification is, and the one idea it runs on
- The four levels -- a scheme you can adopt as-is
- Open a spreadsheet and set up the two tables
- Inventory your data types -- name what you actually hold
- Spot the PII -- the data that raises its own level
- Assign a level to every data type
- Build the handling matrix -- storage, sharing, encryption, retention, disposal
- Label your examples -- make the level visible
- What you built, and the mindset to keep