2 cissp ® Official Study Guide Eighth Edition

Defining Data Classifications 
Organizations typically include data classifi cations in their security policy, or in a separate 
data policy. A
data classifi cation
identifi es the value of the data to the organization and is 
critical to protect data confi dentiality and integrity. The policy identifi es classifi cation labels 
used within the organization. It also identifi es how data owners can determine the proper 
classifi cation and how personnel should protect data based on its classifi cation. 
As an example, government data classifi cations include top secret, secret, confi dential, 
and unclassifi ed. Anything above unclassifi ed is sensitive data, but clearly, these have dif-
ferent values. The U.S. government provides clear defi nitions for these classifi cations. As you 
read them, note that the wording of each defi nition is close except for a few key words.
Top 
secret
uses the phrase “exceptionally grave damage,”
secret
uses the phrase “serious dam-
age,” and
confi dential
uses “damage.” 
Top Secret 
The
top secret
label is “applied to information, the unauthorized disclosure of 
which reasonably could be expected to cause exceptionally grave damage to the national 
security that the original classifi cation authority is able to identify or describe.” 
Secret 
The
secret
label is “applied to information, the unauthorized disclosure of which 
reasonably could be expected to cause serious damage to the national security that the origi-
nal classifi cation authority is able to identify or describe.” 
Confidential 
The
confi dential
label is “applied to information, the unauthorized disclosure 
of which reasonably could be expected to cause damage to the national security that the 
original classifi cation authority is able to identify or describe.” 

---

Identify and Classify Assets