Data Protection Policy

Data Protection Policy

Authorized By: Chief Information Security Officer (CISO)

Purpose/Overview

This Policy establishes the framework for identifying, classifying, and securing Safire’s confidential and sensitive data. This includes corporate intellectual property, consumer data, and regulated information such as Controlled Unclassified Information (CUI), Federal Contract Information (FCI), Personally Identifiable Information (PII), and Electronic Health Information (ePHI).

Safire classifies data based on its sensitivity, value, and criticality to ensure appropriate security controls are applied throughout the data lifecycle.

Scope

This Policy applies to all Safire data, regardless of format (digital or physical), location, or transmission method. It applies to all Safire employees, contractors, consultants, and Third-Party Service Providers (TPSPs) accessing Safire assets, including cloud environments, on-premises systems, and remote devices.

Policy

Roles and Responsibilities

CISO / IT / Compliance (The Oversight Group)

• Framework Management: Define the data classification guidelines and security controls (encryption, access control, logging) for each level.
• Security Controls: Ensure technical controls are implemented to protect High and Medium data pursuant to federal/state regulations.
• Aggregation: Ensure that data merged from multiple sources is protected at the highest applicable classification level.
• Audit & Disposal: Audit data handling practices and ensure secure disposal of data when no longer needed.

Data Owners (Business Unit Leaders)

• Classification: Responsible for categorizing data generated or managed by their department (e.g., HR classifies employee files; Finance classifies banking data) according to this policy.
• Access Reviews: Periodically review who has access to their department’s High/Restricted data.

Data Users (Employees & Contractors)

• Handling: Adhere to the handling requirements for the data they access.

• Email Protocol: High/Restricted data must not be transmitted via standard email. Users must utilize approved encryption methods (e.g., Secure Web Transfer, SFTP) for external transfers.

• Internal Transfer: Only store sensitive data on network drives or cloud repositories authorized for that specific classification level.

• Need to Know: Only share data with individuals who have a legitimate business need and proper authorization.

Third-Party Management

Before sharing data with Third-Party Service Providers (TPSPs), Safire will:

• Perform a security assessment of the TPSP’s controls before exchanging Medium or High data.
• Ensure contracts mandate the protection of Safire data, including encryption in transit and at rest, and breach notification requirements.
• Reserve the right to audit TPSP compliance with these requirements.

Data Classification Levels

Safire utilizes the following three classification levels:

Level 1: High - Restricted

• Definition: Data requiring the highest level of protection under laws, regulations, or contracts. Compromise could result in severe financial penalties, legal action, or reputational damage.
• Examples: CUI, PHI/ePHI, Social Security Numbers, Credit Card Numbers (PCI), Biometrics, Private Keys, Passwords.
• Requirements:
• Access: Strict “Need to Know” with Multi-Factor Authentication (MFA).
• Encryption: Required at rest and in transit.
• Transmission: Must use secure/encrypted channels; standard email prohibited.
• Storage: Approved secure systems only; no local storage on unmanaged devices.

Level 2: Medium - Confidential

• Definition: Proprietary internal data not intended for public disclosure. Unauthorized disclosure could harm the company’s competitive position or violate internal privacy norms.
• Examples: FCI, Non-public policies, Internal memos, Pricing strategies, Org charts, Unpublished contracts.
• Requirements:
• Access: “Need to Know” based on role.
• Encryption: Required in transit; recommended at rest (laptop/mobile).
• Transmission: Encrypted preferred; standard email permitted only internally.

Level 3: Low - Public

• Definition: Information intended for public release or which poses no risk if disclosed.
• Examples: Marketing materials, Press releases, Public website content, Job postings.
• Requirements: No specific security restrictions, though data integrity must be maintained to prevent defacement.

Compliance

Compliance Measurement

The policy owner will verify compliance through methods such as business tool reports and internal and external audits. Oversight is provided by CISO, IT, and Compliance functions. Enforcement of this policy is coordinated through Human Resources and Executive Management.

Exceptions

Any exceptions must be approved by the Policy Owner in advance.

Non-Compliance

An employee found to have violated this policy may be subject to disciplinary action, up to and including termination of employment.

Related Standards, Policies, Plans, and Procedures

Acceptable Use Policy

Access Control Policy

Referenced Terms

CUI

Information that requires safeguarding or dissemination controls pursuant to and consistent with applicable law, regulations, and government-wide policies.

Revision History

2026-08-20 — Darren Rush

Merge pull request #2 from safire-dev/dev (16cb681)

Edit this Page