Four types of Data Classification (Choose two)

Data classification is a fundamental control within an Information Security Management System (ISMS) as outlined by ISO 27001. The process involves categorizing data based on its level of sensitivity, value, and criticality to the organization. This ensures that appropriate security controls are applied. Common classification schemes use labels that represent these sensitivity levels.

"Restricted Data," "Confidential Data," "Unrestricted Data," and "Highly Confidential Data" are all standard examples of classification labels representing different levels of sensitivity. "Unrestricted" typically refers to public information, while "Confidential," "Restricted," and "Highly Confidential" represent progressively higher levels of sensitivity requiring more stringent protection.

B. Project Data, Highly Confidential Data: "Project Data" is a category of information based on its context or origin, not a classification level based on sensitivity.

C. Financial Data, Highly Confidential Data: "Financial Data" describes the type or content of the information, not its specific sensitivity level, which must be determined separately.

1. ISO/IEC 27002:2022 - Information security, cybersecurity and privacy protection — Information security controls.

Control 5.12 Classification of information: This control provides guidance for implementing ISO 27001 Annex A controls. It states, "Information should be classified in terms of legal requirements, value, criticality and sensitivity to unauthorized disclosure or modification." This principle supports using sensitivity-based labels like "Confidential" and "Restricted" and invalidates content-based labels like "Project Data" as classification levels.

2. Stanford University, "Data Classification Guidelines."

Section: "Data Classification Levels and Examples": This document from a reputable academic institution outlines a data classification scheme with levels of "High Risk," "Moderate Risk," and "Low Risk." It explicitly states that High Risk data is also known as "Restricted" or "Confidential," and Low Risk data is "Public" or "Unrestricted." This directly validates the terms used in options A and D as legitimate classification levels. (Available at uit.stanford.edu).

3. Carnegie Mellon University, Information Security Office, "Guidelines for Data Classification."

Section: "Data Classification Levels": This guideline defines a clear three-tiered classification scheme: "Restricted," "Private," and "Public." These levels directly correspond to the concepts of "Restricted Data," "Confidential Data" (as a form of private data), and "Unrestricted Data" (public), confirming the validity of the terms in answers A and D. (Available at cmu.edu/iso).