classification-framework-enforcement

name	classification-framework-enforcement
description	Data classification enforcement, sensitivity labeling, and handling controls per classification level for the CIA platform
license	Apache-2.0

Classification Framework Enforcement Skill

Purpose

This skill provides guidance for enforcing data classification across the Citizen Intelligence Agency platform. It defines classification levels, sensitivity labeling requirements, and mandatory handling controls for each level to ensure consistent data protection aligned with ISMS requirements.

When to Use This Skill

Apply this skill when:

• ✅ Designing new data models or database tables
• ✅ Implementing features that process or display data
• ✅ Reviewing code that handles user data or PII
• ✅ Configuring logging, caching, or data export
• ✅ Assessing data flows between system components
• ✅ Integrating with external data sources
• ✅ Conducting data protection impact assessments

Do NOT use for:

• ❌ Access control implementation (use access-control-policy)
• ❌ Encryption algorithm selection (use crypto-best-practices)
• ❌ Incident response procedures (use incident-response)

Classification Levels

CIA Platform Data Classification

Level	Label	Description	Examples in CIA
Public	🟢 PUBLIC	Freely available information	Published Riksdag votes, public politician profiles, World Bank indicators
Internal	🟡 INTERNAL	For authorized users only	Aggregated analytics, risk scores, trend analysis
Confidential	🟠 CONFIDENTIAL	Restricted access, business-sensitive	User accounts, email addresses, session data
Restricted	🔴 RESTRICTED	Highest protection, regulatory requirements	Passwords, API keys, encryption keys, GDPR-protected PII

Classification Decision Tree

New Data Element
    │
    ├─→ Is it publicly available from source?
    │   ├─→ YES → Is it aggregated/analyzed by CIA?
    │   │   ├─→ YES → 🟡 INTERNAL
    │   │   └─→ NO  → 🟢 PUBLIC
    │   └─→ NO
    │
    ├─→ Is it user-provided personal data?
    │   ├─→ YES → Is it authentication/credential data?
    │   │   ├─→ YES → 🔴 RESTRICTED
    │   │   └─→ NO  → 🟠 CONFIDENTIAL
    │   └─→ NO
    │
    ├─→ Is it a system secret (key, token, password)?
    │   ├─→ YES → 🔴 RESTRICTED
    │   └─→ NO
    │
    └─→ Is it internal analysis or derived data?
        ├─→ YES → 🟡 INTERNAL
        └─→ NO  → 🟢 PUBLIC (default to least restrictive only if certain)

Handling Controls by Classification Level

🟢 PUBLIC Data

Control	Requirement
Storage	Standard database storage
Transmission	HTTPS preferred but not mandatory for read-only
Logging	Can be logged freely
Caching	Can be cached without restrictions
Display	No restrictions on UI display
Export	Can be exported freely
Retention	Follow data source policies
Backup	Standard backup procedures

🟡 INTERNAL Data

Control	Requirement
Storage	Standard database with access controls
Transmission	HTTPS required
Logging	Can be logged, no sensitive aggregation details
Caching	Can be cached with TTL limits
Display	Requires authenticated session
Export	Requires authentication
Retention	1 year default, review annually
Backup	Standard backup with access controls

🟠 CONFIDENTIAL Data

Control	Requirement
Storage	Encrypted at rest (AES-256)
Transmission	TLS 1.2+ required
Logging	Never log confidential field values
Caching	In-memory only, short TTL, no disk cache
Display	Masked by default, reveal on explicit action
Export	Restricted, requires authorization
Retention	Minimum necessary, max 3 years
Backup	Encrypted backup, restricted access
Access	Role-based, principle of least privilege

🔴 RESTRICTED Data

Control	Requirement
Storage	Encrypted at rest + application-level encryption
Transmission	TLS 1.2+ with certificate validation
Logging	Absolutely never log — not even existence
Caching	Never cache
Display	Never display in plaintext
Export	Prohibited without explicit authorization
Retention	Minimum necessary, auto-expire where possible
Backup	Encrypted, separate access controls
Access	Strict need-to-know, multi-factor authentication
Key Management	HSM or AWS KMS, regular rotation

Implementation Patterns

Database Column Classification

@Entity
@Table(name = "application_user")
public class ApplicationUser {

    @Column(name = "username")
    // Classification: CONFIDENTIAL — user-provided, non-public
    private String username;

    @Column(name = "email")
    // Classification: CONFIDENTIAL — PII under GDPR
    private String email;

    @Column(name = "password_hash")
    // Classification: RESTRICTED — credential data
    private String passwordHash;
}

Logging Guard

// DO: Log classification-safe data only
log.info("Processing politician data for id: {}", politicianId);  // PUBLIC id

// DON'T: Log CONFIDENTIAL or RESTRICTED data
// log.info("User login: email={}, password={}", email, password);

// DO: Use placeholder for CONFIDENTIAL data
log.info("User action completed for user id: {}", userId);

Caching Rules

// PUBLIC/INTERNAL: Standard caching allowed
@Cacheable(value = "politicians", key = "#id")
public Politician findPoliticianById(String id) { ... }

// CONFIDENTIAL: Short TTL, in-memory only
@Cacheable(value = "userProfiles", key = "#userId",
    cacheManager = "shortLivedCacheManager")
public UserProfile findUserProfile(String userId) { ... }

// RESTRICTED: Never cache
// No @Cacheable annotation — always fetch from secure storage
public String getApiKey(String serviceId) { ... }

Data Flow Classification

CIA Platform Data Flows

External APIs (Riksdag, World Bank) ──→ Service Layer ──→ Database
    🟢 PUBLIC data                      Classification    Labeled
                                        enforcement       storage
                                            │
                                            ▼
User Browser ◄──── Vaadin UI ◄──── Service Layer
    Display           Encoding        Access control
    controls          applied         enforced

Cross-Boundary Rules

From → To	Allowed Classifications	Controls Required
External API → Service	PUBLIC	Input validation
Service → Database	All	Encryption for CONFIDENTIAL+
Database → Service	All	Access control check
Service → UI	PUBLIC, INTERNAL, CONFIDENTIAL	Output encoding, masking
Service → Logs	PUBLIC, INTERNAL only	Never log CONFIDENTIAL+
Service → Cache	PUBLIC, INTERNAL, Confidential (short TTL)	Never cache RESTRICTED
Any → External	PUBLIC only	Data export review

Compliance Mapping

Classification Control	ISO 27001	NIST CSF	GDPR
Data Classification	A.5.12, A.5.13	ID.AM-5	Art. 5(1)(f)
Labeling	A.5.13	PR.DS-3	Art. 30
Access Control	A.5.15, A.8.3	PR.AC-4	Art. 25
Encryption	A.8.24	PR.DS-1	Art. 32
Logging Controls	A.8.15	DE.AE-3	Art. 30
Retention	A.5.33	PR.IP-6	Art. 5(1)(e)
Data Transfer	A.5.14	PR.DS-2	Art. 44-49

References

• ISO 27001:2022 Annex A — A.5.12-A.5.14 Information Classification
• NIST SP 800-60 Guide for Mapping Information Types
• GDPR Article 5 — Principles Relating to Processing
• Hack23 ISMS Data Classification Policy