2 cissp ® Official Study Guide Eighth Edition

1.
Identify the custodian, and define their responsibilities.
2.
Specify the evaluation criteria of how the information will be classified and labeled.
3.
Classify and label each resource. (The owner conducts this step, but a supervisor 
should review it.)
4.
Document any exceptions to the classification policy that are discovered, and integrate 
them into the evaluation criteria.
5.
Select the security controls that will be applied to each classification level to provide 
the necessary level of protection.
6.
Specify the procedures for declassifying resources and the procedures for transferring 
custody of a resource to an external entity.
7.
Create an enterprise-wide awareness program to instruct all personnel about the clas-
sification system.
Declassification
is often overlooked when designing a classification system and docu-
menting the usage procedures. Declassification is required once an asset no longer warrants 
or needs the protection of its currently assigned classification or sensitivity level. In other 
words, if the asset were new, it would be assigned a lower sensitivity label than it currently 
is assigned. When assets fail to be declassified as needed, security resources are wasted, and 
the value and protection of the higher sensitivity levels is degraded.

---

Evaluate and Apply Security Governance Principles 
21
The two common classifi cation schemes are government/military classifi cation (Figure 1.4 ) 
and commercial business/private sector classifi cation. There are fi ve levels of government/
military classifi cation (listed here from highest to lowest): 
F I G u r e 1. 4
Levels of government/military classification
Top secret
Secret
Confidential
Sensitive but unclassified
Unclassified
High
Low
Top Secret
Top secret
is the highest level of classifi cation. The unauthorized disclosure of 
top-secret data will have drastic effects and cause grave damage to national security. Top-
secret data is compartmentalized on a need-to-know basis such that a user could have 
top-secret clearance and have access to no data until the user has a need to know. 
Secret
Secret
is used for data of a restricted nature. The unauthorized disclosure of 
data classifi ed as secret will have signifi cant effects and cause critical damage to national 
security. 
Confidential
Confi dential
is used for data of a sensitive, proprietary, or highly valuable 
nature. The unauthorized disclosure of data classifi ed as confi dential will have noticeable 
effects and cause serious damage to national security. This classifi cation is used for all data 
between secret and sensitive but unclassifi ed classifi cations.