Security View design intermediate

Data Classification Map

Which data sits in which sensitivity tier, where it lives, and the specific controls each tier obliges — so protection follows the label automatically.

Regulatory Remediation Security Uplift Data Platform Build Cloud-Agnostic Healthcare & Pharma Banking & Payments Cross-Industry Security Regulator & Audit Engineering

flowchart LR
  subgraph t4["Restricted"]
    direction TB
    a1["Card PAN · health records<br/>government ID images"]
    a2["<i>controls:</i> tokenise at edge<br/>field encryption · CMK<br/>no non-prod copies<br/>access JIT + approved<br/>full audit"]
  end
  subgraph t3["Confidential"]
    direction TB
    b1["Personal data · salary<br/>contracts · pricing"]
    b2["<i>controls:</i> encrypt at rest + transit<br/>masked in non-prod<br/>RBAC + quarterly review<br/>DLP on egress"]
  end
  subgraph t2["Internal"]
    direction TB
    c1["Operational metrics<br/>internal docs"]
    c2["<i>controls:</i> authenticated access<br/>standard retention"]
  end
  subgraph t1["Public"]
    direction TB
    d1["Published pricing<br/>marketing content"]
    d2["<i>controls:</i> integrity only"]
  end

  t4 --> s1[("Core DB · EU · Restricted")]
  t3 --> s1
  t3 --> s2[("Warehouse · EU · Confidential")]
  t2 --> s2
  t2 --> s3[("Object store · Internal")]
  t1 --> s3

What it is

The tier ladder, what belongs in each tier, and — the part that makes it operational rather than a policy restatement — the specific controls each tier obliges. Once a dataset is labelled, its encryption, masking, access review cadence, retention and non-production rules follow without further debate.

Four tiers is right. Two is too coarse to drive different controls; six produces arguments about the boundary and inconsistent labelling.

When you produce it

Before a data platform is built, during any regulatory remediation, and whenever someone asks whether a particular dataset can be copied into a test environment and there is no way to answer.

Who reads it

Security and data governance, who own it. Engineers, who implement per-tier controls once instead of per-dataset. Auditors, who check that the label and the actual control agree.

What good looks like

Controls are concrete and testable per tier, not "appropriate measures".
The mapping from tier to storage location is drawn, so residency and co-location are visible.
Derived data inherits the highest tier of its inputs unless a stated transformation lowers it — and the transformation is named.
Labels are applied in the catalogue and enforced automatically, not written in a spreadsheet.

Common mistakes

Tiers with no distinct controls, so labelling changes nothing.
Classifying at system level rather than dataset or column level, forcing the whole system to the highest tier.
Ignoring aggregation. Several Internal fields joined can identify a person, which is a Confidential output from Internal inputs.
Never re-labelling. Sensitivity changes; an annual review belongs in the process.