2 cissp ® Official Study Guide Eighth Edition

Confidential or Proprietary 
The 
confidential
or 
proprietary
label typically refers to the 
highest level of classified data. In this context, a data breach would cause exceptionally
grave damage to the mission of the organization. As an example, attackers have repeatedly 
attacked Sony, stealing more than 100 terabytes of data including full-length versions of 
unreleased movies. These quickly showed up on file-sharing sites and security experts esti-
mate that people downloaded these movies up to a million times. With pirated versions of the 
movies available, many people skipped seeing them when Sony ultimately released them. This 
directly affected their bottom line. The movies were proprietary and the organization might 
have considered it as exceptionally grave damage. In retrospect, they may choose to label 
movies as confidential or proprietary and use the strongest access controls to protect them.
Private 
The 
private
label refers to data that should stay private within the organization but 
doesn’t meet the definition of confidential or proprietary data. In this context, a data breach 
would cause serious damage to the mission of the organization. Many organizations label PII 
and PHI data as private. It’s also common to label internal employee data and some financial 
data as private. As an example, the payroll department of a company would have access to 
payroll data, but this data is not available to regular employees.
Sensitive 
Sensitive
data is similar to confidential data. In this context, a data breach would 
cause damage to the mission of the organization. As an example, information technology 
(IT) personnel within an organization might have extensive data about the internal network 
including the layout, devices, operating systems, software, Internet Protocol (IP) addresses, 
and more. If attackers have easy access to this data, it makes it much easier for them to 
launch attacks. Management may decide they don’t want this information available to the 
public, so they might label it as sensitive.

---

Identify and Classify Assets