2.4 KiB
Title: Data Classification and Handling Policy Document ID: [POL-DATA-CLASS-001] Version: 0.1 Draft Status: Draft Owner: CISO (Paul Jenkins) Approver: CEO (Paul Hague) Classification: Internal Effective date: [DD Month YYYY] Review date: [DD Month YYYY]
Data Classification and Handling Policy
Purpose
This policy defines how BlackDice information must be classified, labelled where appropriate, handled, shared, stored, retained, and disposed of.
Scope
This policy applies to all information created, received, processed, stored, or transmitted within the ISMS scope, regardless of format or location.
Objectives
- ensure information receives protection appropriate to sensitivity and business need
- support consistent handling decisions across teams and systems
- reduce the risk of inappropriate disclosure, alteration, or loss
Principles / Policy Statements
Information must be classified according to its sensitivity, business impact, legal obligations, and contractual requirements.
Handling requirements must align with the assigned classification and apply to storage, access, transfer, retention, and disposal.
Sensitive information must be protected when used in cloud services, engineering workflows, support processes, and customer assurance activities.
Data exports, logs, telemetry, and support artefacts must be reviewed to avoid unnecessary exposure of sensitive or regulated information.
Information shared with suppliers, customers, or operator-hosted environments must be subject to defined handling requirements and appropriate controls.
Roles and Responsibilities
- Information owners must assign classifications and handling requirements where appropriate.
- Users must handle information according to classification and approved process.
- [Role] must maintain the classification framework.
Compliance / Exceptions
Exceptions to standard handling requirements must be formally approved where justified by business need and documented risk.
Monitoring and Review
This policy should be monitored through incident trends, transfer controls, retention practices, supplier review, and audit.
Related Documents
- Information Security Policy
- Information Transfer Policy
- Privacy and Data Protection Policy
- Data Retention Standard
Version Control
| Version | Date | Description of Change | Author |
|---|---|---|---|
| 0.1 Draft | [DD Month YYYY] | Initial draft. | [Name or Role] |