SOC2-C1-DATA-CLASSIFICATION
Data Classification and Handling Policy
What this control does
Policy defining data classification tiers (e.g., Public, Internal, Confidential, Restricted) and the handling requirements for each tier.
Implementation guidance
Define at least three classification tiers. For each tier, specify: encryption requirements, access control requirements, transmission rules, and storage restrictions. Include customer data as Restricted by default. Train all employees on the classification policy annually.
Requirements satisfied
Why it matters
Without consistent data classification, teams apply inconsistent security controls—some customer data ends up stored unencrypted while other internal documents are over-protected, wasting resources and creating compliance blind spots. A clear classification policy ensures customer and sensitive data receive appropriate encryption, access controls, and retention governance, reducing the risk of unauthorized access, breach, and regulatory violations.
Evidence to collect
- Approved Data Classification Policy document with minimum three tiers and handling requirements per tier
- Data classification labeling evidence (e.g., screenshots showing data tagged in database, file metadata, or DLP system)
- Employee training completion records and attendance logs for annual data classification training
- System/database configuration audit showing encryption, access control, and retention settings aligned to classification tier
Testing procedure
Auditor requests the approved data classification policy and verifies it defines at least three tiers with explicit requirements for encryption, access control, transmission, and storage per tier. Auditor then samples five systems/databases (e.g., CRM, file share, data warehouse) and interviews team leads to confirm classified data is labeled and handled per policy; checks encryption status, access logs, and retention settings against the assigned classification. Auditor reviews annual training records to confirm all employees completed classification training within the past 12 months.
Common gotchas
Organizations often define classification tiers but fail to operationalize them—policies sit in a shared drive while teams default to no labeling or use inconsistent tags, rendering the policy unenforceable. Another frequent mistake is classifying all data as "Confidential," eliminating the ability to prioritize controls and creating alert fatigue in DLP and access monitoring tools.