91ÖÆƬ³§

Discover and Classify Your Data

Provide your data with the protection it deserves.

Analyst Perspective

Keep data classification simple.

Data classification is crucial for organizations to protect sensitive information, comply with regulatory requirements, and enhance operational efficiency. It supports better data governance, enabling organizations to optimize storage, improve data accessibility, and enhance decision-making processes.

However, organizations are overwhelmed with data and securing it is a growing challenge. Business and IT leaders can ensure that critical data is protected without wasting resources by keeping data classification simple. Focus on:

• Taking incremental steps; don't try to classify everything immediately.
• Identifying and securing the most critical, high-sensitivity data first.
• Collaborating with data owners to help prioritize key assets.

To streamline the process, integrate data classification into daily workflows, allowing users to label information as they create it. This approach reduces the burden on employees while improving compliance and governance over time. Understanding where critical data resides and how it is protected enables organizations to justify security investments and enhance overall data protection and governance strategies.

Logan Rohde
Cybersecurity Advisor
Security and Privacy
91ÖÆƬ³§

Safayat Moahamad
91ÖÆƬ³§ Director
Security and Privacy
91ÖÆƬ³§

Executive Summary

Info-Tech Insight

Avoid analysis paralysis. Classifying all your data at once may not be feasible. Start small, quantify your results, report them to management, and then go back and tackle a larger portion.

Your Challenge

This research is designed to help organizations design a process to discover and classify their data.

• Data classification is the process of organizing data into relevant categories. Classification helps improve information security and privacy by enabling the assignment of access permissions and the implementation of protection measures for different kinds of data.
• Without a consistent process to discover and classify sensitive or critical data, you won't be able to identify what data is at high risk of being leaked or stolen. Prioritize risk mitigation initiatives to prevent a data breach or determine how to scale investment in data loss prevention tools.

Data discovery and classification is the first step in protecting high-risk data from malicious actors.

Average data breach costs rose from $3.86 million, in 2020, to $4.88 million in 2024. It is the highest average total cost in the history of this report. Costs were significantly lower for organizations with a more mature security posture.

Source: IBM, 2024

Common Obstacles

Data discovery can be daunting. Avoid analysis paralysis.

• Large data backlogs can make it difficult to figure out where to start. Classifying all your data at once may not be feasible.
• You have a limited budget. You need to understand where you need the most protection against data breaches so you can save on storage costs.
• The dynamic nature of data complicates matters. The criticality of a piece of data shifts over time. Your data classification program will need to incorporate reassessments to prevent overprotecting the data.

You can't secure high-risk data that you haven't identified. Focus the program to classify what matters. The classification program should be measurable, auditable, and manageable.

Over three out of ten respondents at companies that did not perform data mapping or inventory, data retention, data tagging, or training and awareness reported they were not at all confident about compliance.

Source: IAPP, 2024

Insight summary

Provide your data with the protection it deserves.

Avoid analysis paralysis.

• Classifying all your data at once may not be feasible. Start small, quantify your results, report them to management, and then go back and tackle a larger portion.

Keep it simple.

• Leave as little ambiguity as possible for an easy-to-follow classification program. Clearly define the roles and responsibilities of everyone involved, from data custodians to data users.

Data, by its nature, does not stay static.

• A piece of data's criticality will peak, but strategic reassessment will eliminate under/overprotection of data. Data classification must be a program, not a one-time project.
• Successful risk mitigation is dependent on knowing your data's criticality and where it lives. While data discovery can be overwhelming, strategic interviews with data owners, in addition to the use of technology, are starting steps to mapping data.
• This information leads to more accurate threat modeling and security controls investments.

Focus the program on measurable, auditable, and manageable classification.

• Perform data location analysis and security analysis to inform your overall security initiatives. Understand which departments own the most sensitive data and provide training to improve awareness.
• Use the classification distribution visuals to make strategic decisions such as which security controls and processes your organization should expand and which repositories it should consolidate.

Blueprint deliverables

Each step of this blueprint is accompanied by supporting deliverables to help you accomplish your goals:

Steering Committee Charter
Classification Policy
Classification Standard
Data Classification RACI
User Data Handling Requirements

Develop a classification program.

Data Discovery Interview Tracking

Incorporate human and technology-based tools to simplify discovery.

Inventory Tool
Verification Tool
Metrics Tracking Tool
Awareness Pamphlet
Awareness Poster

Implement the classification program to ensure appropriate levels of protection.

Key deliverable:

Data Classification Inventory Tool

Use this tool to define your classification scheme, track and consolidate the classification of corporate assets, and gain visibility into the location and security of your organization's most sensitive data.

Info-Tech offers various levels of support to best suit your needs

Diagnostics and consistent frameworks are used throughout all five options.

Guided Implementation

What does a typical GI on this topic look like?

A Guided Implementation (GI) is a series of calls with an Info-Tech analyst to help implement the project.

A typical GI for this project is four to six calls over the course of four to six months.

Workshop Overview

Contact your account representative for more information.
workshops@infotech.com 1-888-670-8889

Measure the value of this blueprint

After each Info-Tech experience, we ask our members to quantify the real-time savings, monetary impact, and project improvements our research helped them achieve.

Overall Impact

9.5 / 10

Overall Average Savings

$166,020

Overall Average Days Saved

49

Phase 1

Formalize the Classification Program

Phase 1

1.1 Establish a steering committee
1.2 Formalize data classification policy

Phase 2

2.1 Plan data discovery efforts
2.2 Implement data discovery plan

Phase 3

3.1 Classify the data
3.2 Maintain and optimize the program

This phase will walk you through the following activities:

• Develop a steering committee charter
• Create a data classification policy
• Develop a data classification standard
• Assign roles and responsibilities in the data classification program

This phase involves the following participants:

• Security leader
• Data steward
• Data custodian
• Data owners
• Legal representative
• Data user representative

Outcomes of this step

• Identify compliance regulations
• 91ÖÆƬ³§ steering committee
• Define roles and responsibilities
• Formalize requirements and definitions
• Documented data handling requirements and procedures

Step 1.1

Establish a steering committee

Agenda

Review the core governance structure.
Develop a data classification steering committee.
Develop a data classification steering committee charter.

This step will walk you through the following activities:

• Assemble the data classification steering committee
• Formalize the steering committee charter

This step involves the following participants:

• Security leader
• Data steward
• Data custodian
• Data owners
• Legal representative
• Data user representative

Outcomes of this step

• A data classification steering committee to serve as the foundational governance structure that is supported by a charter, capturing the objectives and mode of operations for the program.

Formalize the Classification Program

Activity 1.1 > Activity 1.2

Review the core governance structure

Organizations need to identify roles and responsibilities at strategic, tactical, and operational levels; establish a data classification steering committee; and identify all stakeholders that will support the program. Maturity, organization size, and enterprise governance structure will influence the program governance structure.

Develop a data classification steering committee

Purpose

The data classification steering committee (DCSC) will ensure that project goals are on target for timely completion by overseeing:

• The data discovery and classification process plus the classification of data stores.
• The creation, destruction, and storage of information in any medium.
• Information systems associated with the organization.

Goals

• Ensure that all involved personnel understand the discovery and classification protocol and why these processes have been initiated.
• Provide strategic leadership for the classification initiative to align with corporate objectives.
• Resolve unanticipated issues that arise during the discovery/classification of data by establishing a consensus on how best to proceed.
• Establish open communication between data users and owners and all other roles.

Establish a steering committee to bridge the gap between data classification business requirements and technical capabilities.

Establish an effective data classification steering committee

Establishing an Effective DCSC

Develop an agenda and clearly identify activities, adhering to time allotments.

Define job descriptions for each DCSC member to outline their respective duties and responsibilities to encourage accountability.

Set quorum at 50% of DCSC members so that operations can continue without full attendance but not without a majority.

Seek diverse points of view but limit the overall number of committee members to avoid unnecessary competition.

Avoid half-day or all-day meetings; they are unproductive and often lead to frustration. Meetings should last no longer than 90 minutes.

Activity 1.1.1

Formalize the steering committee charter

The data classification steering committee (DCSC) charter defines the role of the DCSC and outlines the goals, scope, and purpose of the data discovery/classification effort. It highlights specifics such as membership, mandate, and meeting agenda.

1. To ensure the template reflects the goals and requirements of your organization's data classification effort, simply replace or remove the grey text in the document.?
2. Evaluate the usefulness of the tips sections for your organization and deploy them as you see fit.?
3. Use the Appendix to define Pre-Work, First Meeting, and Second Meeting Agenda items.

Download the Data Classification Steering Committee Charter template

Step 1.2

Formalize data classification policy

Agenda

Determine your data classification scheme.
Develop the data classification policy.
Develop the data classification standard.
Define the data classification RACI.

This step will walk you through the following activities:

• Formalize the policy with your classification scheme
• Formalize the standard, including data handling requirements and necessary disclaimers
• Assign roles in the RACI chart

This step involves the following participants:

• Security leader
• Data steward
• Data custodian
• Data owners
• Legal representative
• Data user representative

Outcomes of this step

A policy that details the roles and responsibilities needed to execute a successful program as well as a clear and concise classification standard that can be promptly implemented in your organization.

Formalize the Classification Program

Activity 1.1. > Activity 1.2

Determine your classification scheme

Stakeholders will find simple and intuitive classification schemes easier to use.

• Data is classified based on a hierarchy of sensitivity.
• This hierarchy typically has three to five tiers, depending on the impact of the data being exposed or compromised.
• On the next few slides, there is a variety of potential classifications. Discuss those that apply to your organization.