Data classification is the process of categorizing data into various types, forms, sensitivity level, or any other grouping of similar characteristics. When a piece of information (e.g., a document, memo, or customer record) is created, the owner assigns a standard classification level which defines the prescribed handling requirements for that piece of information, among other things. Such categories dictate the controls necessary to best protect the confidentiality, integrity, and availability of the data.

Data classification makes securing data much more efficient, because it instantly identifies and communicates the minimum level of protection required for any piece of data as well as the audience that may view it. For example, a document that is classified as "confidential" is easily understood to require additional protections and controls.

The Office of the Chief Information Security Officer at the Texas Department of Information Resources (DIR) worked with a taskforce of agency stakeholders to develop a model data classification taxonomy for state agencies and institutes of higher education. The classification scheme is detailed separately from this guidance document. This document is meant to present the background, underlying assumptions, and logic behind the decisions the taskforce made in arriving at this model.

Texas Administrative Code (TAC) Chapter 202 requires all agencies and institutions of higher education to classify their data.[1] However, TAC 202 does not explicitly define classification levels beyond the "confidential" category.[2] The lack of standardization in data classification schemes across the state creates challenges such as inefficiency in communications, discrepancies in controls applied between agencies, and in rare cases, a neglect to implement data classification policies and procedures entirely. To address these challenges, the Office of the Chief Information Security Officer (OCISO) worked with representatives from multiple state agencies to develop a baseline data classification scheme that can be adopted and modified to meet the varying needs of agencies and institutions of higher education.

Based on the experience of these representatives and their understanding of security standards and best practices, the OCISO proposes a simple classification scheme for all agencies to consider. The representatives based their classification scheme on current Texas law, both 1 TAC 202 and the Public Information Act, as well as the relevant federal standards (FIPS 199, NIST SP 800-59 and 800-60).

Data classification is the basis for identifying an initial baseline set of security controls for information and information systems, which creates numerous benefits for the organization.

Effectively classifying data makes security decisions more efficient for employees, data owners, and IT staff, because it instantly identifies and communicates the level of protection required for any piece of data and who can access it. Establishing a common statewide vernacular can further amplify this efficiency through clear and non-ambiguous communication.

Appropriate data classification can also enable a more efficient use of IT capital. Specifically, data that has been categorized at a level requiring more protection can provide an objective justification for certain capital expenditures to help protect that data. 

An organization can design its systems architecture with varying information sensitivity levels in mind if there is an awareness of the location, type, and handling requirements of the data. This may assist in achieving economies of scale with security services and protection through shared network and security zones. For example, an information system containing information protected by state privacy laws may be stored with other information systems containing similar sensitive information which are regulated by a third-party agreement.

Agency contingency and disaster recovery planning personnel can use the outputs of the data classification process to ensure that the infrastructure is sufficiently protected and that recovery efforts focus on high impact systems.

Finally, artifacts of a data classification process can also serve as inputs to Business Impact Analysis (BIA) reviews, Information Sharing and System Interconnection Agreements, and audit trails.