A financial institution, GHI Bank, is migrating its customer data to a cloud environment. To ensure data security and compliance with financial…

An effective data classification policy must go beyond simply assigning labels. Its primary purpose is to ensure that data is protected according to its sensitivity and criticality. Therefore, the policy must include specific, actionable procedures for handling, storing, transmitting, and destroying data within each classification level. This provides clear guidance to employees and systems on how to apply appropriate security controls, such as encryption, access control, and data loss prevention, thereby making the policy operational and enforceable. Without these detailed procedures, the classification labels themselves are meaningless and the policy cannot be effectively implemented.

A. A single encryption standard is too rigid; different data levels may require different encryption strengths, making this approach inefficient and potentially non-compliant.

B. This describes a data retention/destruction schedule, not a classification policy. Arbitrarily deleting all classified data quarterly is operationally destructive and illegal.

C. Classifying all data as top-secret negates the purpose of classification, which is to apply controls proportional to data sensitivity and value.

1. Cloud Security Alliance (CSA). (2017). Security Guidance for Critical Areas of Focus in Cloud Computing v4.0. Domain 4: Cloud Data Security, Section 4.3.1 Data Classification, p. 49. "The classification should drive the level of security controls applied to the data."

2. National Institute of Standards and Technology (NIST). (2020). NIST Special Publication 800-53 Revision 5: Security and Privacy Controls for Information Systems and Organizations. Control Family: System and Information Integrity (SI), Control: SI-12 Information Handling and Retention, p. 289. This control requires the organization to "handle and retain information consistent with applicable laws, executive orders, directives, policies, regulations, standards, and operational requirements." This implies that different types of information (classifications) require different handling.

3. von Solms, B., & von Solms, R. (2004). The 10 deadly sins of information security management. Computers & Security, 23(5), 371-376. https://doi.org/10.1016/j.cose.2004.05.002. The paper discusses the importance of a structured information security governance framework, where classification is a foundational step to applying appropriate controls.