June 1. Purpose
The purpose of this policy is to ensure that Acme Inc. data is appropriately classified, protected, and handled throughout its lifecycle—creation, storage, use, transmission, and destruction. Proper classification supports compliance, risk management, and operational efficiency.
⸻
This policy applies to: • All Acme Inc. employees, contractors, partners, and third parties with access to Acme Inc. data. • All data created, stored, transmitted, or processed on behalf of Acme Inc., regardless of format (structured/unstructured, paper/digital). • All systems and services handling Acme Inc. data, including SaaS, IaaS, and on-prem environments.
⸻
Acme Inc. classifies data into four tiers:
Classification Description Examples Restricted Data that, if disclosed, could cause severe harm to Acme Inc. or its customers. Access is tightly controlled. PII, trade secrets, authentication credentials, incident response plans, encryption keys, unreleased financials Confidential Sensitive internal data that must be protected due to contractual, legal, or business risk. Source code, internal strategy docs, vendor contracts, unpublished analytics Internal Use Only Non-public data intended for internal collaboration but not harmful if accidentally exposed to third parties. Org charts, team wikis, most internal emails Public Data approved for public disclosure. No confidentiality required. Website content, published press releases, marketing materials
⸻
Employees & Contractors: • Understand and apply this policy to all data they handle • Label documents according to classification level • Use approved tools for storage and sharing (e.g., secure file shares, encrypted mail)
Data Owners: • Assign classification levels for the data they create or manage • Review classification as data changes in sensitivity or lifecycle • Define who may access data and under what conditions
IT & Security Teams: • Provide systems to support data classification and protection (e.g., DLP, encryption, monitoring) • Monitor adherence and respond to violations • Maintain audit logs of access to Restricted and Confidential data
⸻
Classification Labeling Requirements Restricted Header/footer labeling, encryption at rest and in transit, access control logs Confidential Document labeling, ACLs, email protection, no third-party sharing without approval Internal Use Only Optional label, internal storage required Public No label required
Automated labeling tools (e.g., MIP, Google DLP, S/MIME) must be used where available.
⸻
Level Access Control Handling Instructions Restricted Need-to-know basis, MFA required, access logged Never shared via public tools (e.g., Gmail, Dropbox) Confidential Role-based access, shared only with authorized users Share via encrypted channels Internal Use Only Default internal access, no external sharing Avoid posting to public forums Public Openly accessible, must be approved for release May be posted on public platforms
⸻
⸻
Any exceptions must be approved in writing by the CISO or delegate, with documentation and risk assessment.
⸻
Violations of this policy may lead to disciplinary action, up to and including termination or legal consequences, in accordance with Acme Inc.’s Code of Conduct and employment agreements.
⸻
This policy will be reviewed annually or upon major business or regulatory changes.
⸻
• ISO/IEC 27001 & 27002
• NIST SP 800-60, 800-171
• GDPR, HIPAA, SOX, and other relevant regulations