Classification

Go up to Terms and Definitions

Classification assigns an item to one or more defined categories according to specified criteria.

The classified item includes Data, Information, an artifact, a configuration value, a resource, a system, a finding, a risk, or another subject requiring consistent treatment.

A classification scheme defines the available categories, assignment criteria, responsible authority, handling consequences, review conditions, and relationships among categories. Classification applies the scheme to a particular item.

A Classification remains distinct from a label. A Classification records the category assigned to an item. A label represents or communicates that Classification within a document, interface, record, message, or physical marking.

A Classification also remains distinct from a handling rule. The Classification identifies the applicable category. A handling rule specifies the controls and actions associated with that category.

assignment of an item to a defined category according to specified criteria

DIDO Solutions project definition informed by ISO/IEC information-classification and classification terminology.

A Classification identifies the applicable classification scheme, assigned category, classified item, assignment criteria, responsible authority, effective period, and classification status.

An item has more than one Classification when different classification schemes address different concerns. Information, for example, has a security Classification, retention Classification, regulatory Classification, and operational Classification.

A Classification change records the previous category, resulting category, responsible authority, reason, and effective time.

Classification criteria support consistent assignment. A category name or label without defined assignment criteria does not provide a reproducible Classification.

A Node Configuration parameter containing a private key receives a confidential security Classification. The Classification associates the value with Security Controls governing access, storage, transfer, logging, rotation, retention, and disposal.