Lion Cipher Lab
Classify your own data (and match protection to sensitivity)
- GRC / Compliance
- Beginner
- ~45 min
- Free · no account required
Why it matters
Every security decision downstream — what to encrypt, who gets access, how long to keep something, how to destroy it — depends on one thing being done first: knowing how sensitive the data is. "You can't protect what you haven't classified" is not a slogan; it is the reason data-governance teams exist. Over-protect everything and people route around the controls; under-protect the wrong file and a breach of it becomes the headline. The U.S. standards much of the industry runs on are built around categorizing information by the harm its loss would cause, and then matching the safeguards to…
What you'll learn
- data classification
- data governance
- PII
- handling & retention rules
- matching controls to sensitivity
Steps in this lab
- You can't protect what you haven't classified
- A simple four-level scheme
- What makes data "Restricted": PII and the sensitive kinds
- Inventory your own data first
- Classify each item — a worked table
- Write the handling rule for each level
- Why a breach of "Restricted" data is the one that hurts
- What you just did — and why it counts