classification-policy

# Data Classification Policy Skill ## Purpose This skill provides systematic guidance for implementing risk-based data and asset classification within the CIA platform, ensuring proper protection controls align with information sensitivity, business impact, and regulatory requirements per ISO 27001 A.5.12, A.5.13, and A.8.10. ## When to Use This Skill Apply this skill when: - ✅ Designing data models with sensitive information (personal data, political records) - ✅ Implementing access controls for classified information - ✅ Defining encryption requirements for data at rest and in transit - ✅ Creating data handling procedures (storage, transmission, disposal) - ✅ Conducting privacy impact assessments (GDPR compliance) - ✅ Establishing retention and disposal policies - ✅ Labeling data assets in documentation or code - ✅ Configuring security controls for different sensitivity levels Do NOT skip for: - ❌ "Internal-only" systems (still require classification) - ❌ Development/test data (may contain production data copies) - ❌ Temporary data stores (still subject to classification) - ❌ Public APIs (may expose classified data) ## 4-Tier Classification Model ### Classification Levels Overview ```mermaid graph TD subgraph Classification["🏷️ Classification Tiers"] RESTRICTED["🔴 RESTRICTED<br/>Extreme Confidentiality<br/>National Security Level"] CONFIDENTIAL["🟠 CONFIDENTIAL<br/>High Confidentiality<br/>Business Sensitive"] INTERNAL["🟡 INTERNAL<br/>Moderate Confidentiality<br/>Company Use Only"] PUBLIC["🟢 PUBLIC<br/>No Confidentiality<br/>Publicly Accessible"] end subgraph CIA["🛡️ CIA Triad Mapping"] CONF["🔒 Confidentiality<br/>Data Secrecy"] INT["✅ Integrity<br/>Data Accuracy"] AVAIL["⏱️ Availability<br/>Data Access"] end subgraph Controls["🔐 Security Controls"] ENCRYPTION["🔐 Encryption Requirements"] ACCESS["🚪 Access Controls"] AUDIT["📊 Audit Logging"] RETENTION["📅 Retention Policy"] end RESTRICTED --> CONF RESTRICTED --> INT RESTRICTED --> AVAIL CONFIDENTIAL --> CONF CONFIDENTIAL --> INT CONFIDENTIAL --> AVAIL INTERNAL --> INT INTERNAL --> AVAIL PUBLIC --> AVAIL CONF --> ENCRYPTION CONF --> ACCESS INT --> AUDIT AVAIL --> RETENTION style Classification fill:#1565C0 style CIA fill:#4CAF50 style Controls fill:#FF9800 ``` ### 🔴 RESTRICTED - Extreme Confidentiality **Definition**: Information requiring maximum protection due to severe business, legal, or regulatory consequences if disclosed. **CIA Triad Mapping**: - **Confidentiality**: [](https://github.com/Hack23/ISMS-PUBLIC/blob/main/CLASSIFICATION.md) - Unauthorized disclosure causes catastrophic damage - **Integrity**: [](https://github.com/Hack23/ISMS-PUBLIC/blob/main/CLASSIFICATION.md) - Data tampering creates legal liability - **Availability**: [](https://github.com/Hack23/ISMS-PUBLIC/blob/main/CLASSIFICATION.md) - Authorized access required for compliance **Examples in CIA Platform**: - Encryption keys and cryptographic secrets - Database credentials and connection strings - OAuth tokens and API keys - Personal Identity Numbers (Swedish personnummer) - Authentication credentials and password hashes **Mandatory Security Controls**: | Control Type | Requirement | Implementation | |--------------|-------------|----------------| | **Encryption at Rest** | AES-256 or stronger | AWS KMS, encrypted EBS volumes | | **Encryption in Transit** | TLS 1.3 minimum | HTTPS only, HSTS enabled | | **Access Control** | Zero-trust, MFA required | RBAC, least privilege principle | | **Audit Logging** | All access logged with retention | CloudWatch Logs, 1-year retention | | **Labeling** | Explicit marking required | Code comments, doc headers | | **Retention** | Minimum required, immediate disposal | Automated purging after expiry | **Java Implementation Example**: ```java /** * CLASSIFICATION: RESTRICTED * Contains database credentials - never log or expose * * @see <a href="https://github.com/Hack23/ISMS-PUBLIC/blob/main/CLASSIFICATION.md">Classification Policy</a> * @see <a href="https://github.com/Hack23/ISMS-PUBLIC/blob/main/Cryptography_Policy.md">Cryptography Policy</a> */ @Configuration public class DatabaseConfig { // RESTRICTED: Database password from encrypted secrets manager @Value("${spring.datasource.password}") private String databasePassword; @Bean public DataSource dataSource() { HikariConfig config = new HikariConfig(); config.setJdbcUrl(System.getenv("DB_URL")); config.setUsername(System.getenv("DB_USERNAME")); // NEVER log or print RESTRICTED data config.setPassword(databasePassword); // Enable connection encryption (TLS 1.3) config.addDataSourceProperty("ssl", "true"); config.addDataSourceProperty("sslmode", "verify-full"); return new HikariDataSource(config); } @Override public String toString() { return "DatabaseConfig{password=***REDACTED***}"; } } ``` **Handling Requirements**: - ❌ NEVER store in source code or version control - ❌ NEVER log to application logs or console - ❌ NEVER transmit over unencrypted channels - ❌ NEVER store in plaintext configuration files - ✅ Store in AWS Secrets Manager or Parameter Store - ✅ Inject via environment variables at runtime - ✅ Rotate regularly (minimum quarterly) - ✅ Immediate revocation when compromised ### 🟠 CONFIDENTIAL - High Confidentiality **Definition**: Business-sensitive information with significant financial, operational, or competitive impact if disclosed. **CIA Triad Mapping**: - **Confidentiality**: [](https://github.com/Hack23/ISMS-PUBLIC/blob/main/CLASSIFICATION.md) - Disclosure causes major business harm - **Integrity**: [](https://github.com/Hack23/ISMS-PUBLIC/blob/main/CLASSIFICATION.md) - Unauthorized modification creates business risk - **Availability**: [](https://github.com/Hack23/ISMS-PUBLIC/blob/main/CLASSIFICATION.md) - Business continuity depends on access **Examples in CIA Platform**: - Political party financial records (detailed budget data) - Ministerial expense reports (before public release) - Internal security vulnerability assessments - Business strategy and competitive analysis - System architecture diagrams with security details **Mandatory Security Controls**: | Control Type | Requirement | Implementation | |--------------|-------------|----------------| | **Encryption at Rest** | AES-256 recommended | Database encryption, encrypted backups | | **Encryption in Transit** | TLS 1.2 minimum | HTTPS, secure API calls | | **Access Control** | RBAC with quarterly reviews | Spring Security, user roles | | **Audit Logging** | Access events logged | Application logs, 90-day retention | | **Labeling** | Classification marking recommended | Document headers, metadata | | **Retention** | Business-driven retention | 7 years for financial data | **Java Implementation Example**: ```java /** * CLASSIFICATION: CONFIDENTIAL * Contains business-sensitive political party financial data * * Access restricted to authenticated users with PARTY_ANALYST role * All access logged per ISO 27001 A.8.15 */ @Entity @Table(name = "party_financial_record") public class PartyFinancialRecord { @Id @GeneratedValue(strategy = GenerationType.IDENTITY) private Long id; @Column(name = "party_id", nullable = false) private String partyId; // CONFIDENTIAL: Detailed budget breakdown @Column(name = "budget_json", columnDefinition = "jsonb") @Convert(converter = JsonConverter.class) private Map<String, BigDecimal> detailedBudget; @Column(name = "fiscal_year") private Integer fiscalYear; @CreatedDate @Column(name = "created_at", nullable = false) private LocalDateTime createdAt; @CreatedBy @Column(name = "created_by") private String createdBy; } @Service public class PartyFinancialService { private final AuditLogger auditLogger; @PreAuthorize("hasRole('PARTY_ANALYST') or hasRole('ADMIN')") @Audited(message = "Access to CONFIDENTIAL party financial data") public PartyFinancialRecord getFinancialRecord(Long recordId, String userId) { // Log access to CONFIDENTIAL data auditLogger.logDataAccess( "CONFIDENTIAL", "party_financial_record", recordId, userId ); return financialRepository.findById(recordId) .orElseThrow(() -> new ResourceNotFoundException("Record not found")); } } ``` **Handling Requirements**: - ❌ NEVER share with unauthorized external parties - ❌ NEVER store on unencrypted removable media - ❌ NEVER transmit via unencrypted email - ✅ Encrypt before email transmission (if required) - ✅ Access requires authentication and authorization - ✅ Mark documents with "CONFIDENTIAL" header - ✅ Securely dispose when no longer needed ### 🟡 INTERNAL - Moderate Confidentiality **Definition**: Information intended for internal use only, with moderate business impact if disclosed externally. **CIA Triad Mapping**: - **Confidentiality**: [](https://github.com/Hack23/ISMS-PUBLIC/blob/main/CLASSIFICATION.md) - External disclosure creates moderate risk - **Integrity**: [](https://github.com/Hack23/ISMS-PUBLIC/blob/main/CLASSIFICATION.md) - Modification affects business operations - **Availability**: [](https://github.com/Hack23/ISMS-PUBLIC/blob/main/CLASSIFICATION.md) - Business operations continue with delays **Examples in CIA Platform**: - Internal project planning documents - System performance metrics and analytics - Employee directory and contact information - Internal training materials - Aggregated usage statistics (anonymized) **Security Controls**: | Control Type | Requirement | Implementation | |--------------|-------------|----------------| | **Encryption at Rest** | Recommended for sensitive subsets | Database encryption optional | | **Encryption in Transit** | TLS 1.2 for external access | HTTPS for web interfaces | | **Access Control** | Authentication required | Standard user accounts | | **Audit Logging** | Significant events logged | Basic application logs | | **Labeling** | Classification marking optional | File metadata preferred | | **Retention** | Standard business retention | 3 years typical | **Java Implementation Example**: ```java /** * CLASSIFICATION: INTERNAL * System performance metrics for internal monitoring * * Access requires authentication */ @Entity @Table(name = "system_metrics") public class SystemMetrics { @Id @GeneratedValue(strategy = GenerationType.IDENTITY) private Long id; @Column(name = "metric_name") private String metricName; @Column(name = "metric_value") private Double metricValue; @Column(name = "timestamp") private LocalDateTime timestamp; @Column(name = "server_id") private String serverId; } @RestController @RequestMapping("/api/internal/metrics") public class MetricsController { // INTERNAL: Requires authenticated user @GetMapping @PreAuthorize("isAuthenticated()") public ResponseEntity<List<SystemMetrics>> getMetrics( @RequestParam LocalDateTime startTime, @RequestParam LocalDateTime endTime) { List<SystemMetrics> metrics = metricsService.findByTimeRange(startTime, endTime); return ResponseEntity.ok(metrics); } } ``` **Handling Requirements**: - ❌ NEVER publish to public websites or repositories - ❌ NEVER share with external parties without approval - ✅ Share with authenticated internal users - ✅ Use standard email for internal distribution - ✅ Standard backup and retention procedures - ✅ Dispose using normal deletion procedures ### 🟢 PUBLIC - No Confidentiality **Definition**: Information approved for public disclosure with no confidentiality requirements. **CIA Triad Mapping**: - **Confidentiality**: [](https://github.com/Hack23/ISMS-PUBLIC/blob/main/CLASSIFICATION.md) - Intended for public consumption - **Integrity**: [](https://github.com/Hack23/ISMS-PUBLIC/blob/main/CLASSIFICATION.md) - Accuracy important for reputation - **Availability**: [](https://github.com/Hack23/ISMS-PUBLIC/blob/main/CLASSIFICATION.md) - High availability expected by public **Examples in CIA Platform**: - Public API documentation - Open-source code repositories (GitHub public repos) - Published voting records (already public from Riksdagen) - Press releases and marketing materials - Public data visualizations and dashboards **Security Controls**: | Control Type | Requirement | Implementation | |--------------|-------------|----------------|