Data Classification Policy

Data Classification Policy

Authorized By: Chief Information Security Officer (CISO)

Purpose/Overview

This policy sets forth Safire, Inc.’s information handling requirements to ensure the confidentiality, integrity, and availability of all Safire Information. This includes, but is not limited to, customer information, Personally Identifiable Information (PII), Protected Health Information (PHI), Controlled Unclassified Information (CUI), and intellectual property.

Scope

This Policy applies to all Safire Information, regardless of format (digital or physical), wherever it is stored, processed, or transmitted. It applies to all Safire employees, contractors, consultants, and Third-Party Service Providers (TPSPs) utilizing Safire assets, including cloud environments, onpremises systems, and remote devices.

Policy

Safire’s Data Classification Policy defines three categories of information. Protection requirements are mandated based on these categories:

High - Restricted

• Definition: Information where unauthorized disclosure could cause severe damage to Safire, national security, or individuals. This explicitly includes Controlled Unclassified Information (CUI) , PHI, and Highly Sensitive PII (e.g., SSNs, Financial Accounts).
• System Requirement: All information meeting the High - Restricted classification shall only be stored, processed, or handled by assets (systems, databases, endpoints) that meet or exceed the requirements defined in NIST Special Publication 800-171.

Medium - Confidential

• Definition: Proprietary information internal to Safire or standard business data (e.g., internal memos, pricing lists, non-sensitive PII, employee directories).
• System Requirement: All information meeting the Medium - Confidential classification shall only be handled by assets that meet or exceed the requirements defined in the US Federal Acquisition Regulations (“FAR”) 52.204-21 (Basic Cyber Hygiene).

Low - Public

• Definition: Information intended for public release or requiring no specific protection (e.g., marketing materials, public website content).
• System Requirement: While public, these assets must still be protected against unauthorized modification or destruction, meeting standard IT best practices.

Marking and Labeling Requirements

To ensure employees and systems can identify sensitive data, the following marking protocols must be observed:

• Digital CUI/Restricted: Documents containing CUI must include a “Controlled” or “CUI” marking in the header or footer. Emails containing Restricted data must be encrypted and labeled appropriately in the subject line.
• Physical Media: Removable media (USB drives, external hard drives) and physical files containing Restricted information must be physically labeled with the appropriate classification level.
• System Notices: Information systems processing CUI shall display system use notifications indicating the system contains controlled information.

Handling and Transmission

• Encryption: High - Restricted data must be encrypted both at rest and in transit using FIPS-validated cryptography.
• Public Release: Information classified as Medium or High must not be posted to publicfacing websites, social media, or public file shares without explicit written authorization from the Data Owner.

Compliance

The policy owner will verify compliance through methods such as business tool reports and internal and external audits. Oversight is provided by CISO, IT, and Compliance functions. Enforcement of this policy is coordinated through Human Resources and Executive Management.

Exceptions

Any exceptions must be approved by the Policy Owner in advance.

Non-Compliance

An employee found to have violated this policy may be subject to disciplinary action, up to and including termination of employment.

Related Standards, Policies, Plans, and Procedures

• Media Protection Policy
• Access Control Policy
• Acceptable Encryption Policy

Referenced Terms

CUI

Information that requires safeguarding or dissemination controls pursuant to and consistent with applicable law, regulations, and government-wide policies.

Revision History

2026-08-20 — Darren Rush

Merge pull request #2 from safire-dev/dev (16cb681)

Edit this Page