Theory: Data Classification & the Three States of Data
We know we must protect confidentiality and privacy, but an organization cannot protect everything to the maximum: it would cost too much and make work impossible. Data classification tells us where to focus: which data needs heavy protection and which can be handled lightly. Then, because the same data moves (stored, sent, viewed), we look at the three states of data and the safeguards each one needs.
What Is Data Classification?
Data classification is grouping data by its sensitivity, that is, by the impact if it is exposed, in order to decide what level of protection each type of data deserves.
Three classification criteria decide which level a piece of data belongs to:
- Impact if the data is disclosed: how much harm to the organization or to individuals?
- Legal requirements that apply: is the data protected by law (for example, health data under PDPA)?
- What the data owner expects: would the person or department that owns the data expect it to be kept private?
Link to Week 3 (risk): higher classification → higher impact → higher risk score. Classification is really an impact assessment done in advance, so risk treatment money goes to the data that matters most.
A Common 4-Level Framework
| Level | Meaning | MediCare Plus example |
|---|
| Public | No harm if disclosed | Published service price list |
| Internal | Limited harm; for internal use only | Internal department memo |
| Confidential | Real harm to the organization | Employee salary records |
| Restricted | Severe harm / legal exposure | Patient medical records |
Why patient records are Restricted, not just Confidential: health data is sensitive personal data under PDPA (see 7.3), so disclosure causes severe harm to patients and legal exposure (fines, lawsuits, criminal liability) for the hospital. Salary records hurt the organization and employees if leaked, but carry less legal weight, so they sit one level lower.
Common mistake: classifying by who created the data or where it is stored. Classify by impact if disclosed, legal requirements and owner expectations. A price list on the hospital server is still Public; a patient list printed on paper is still Restricted.
Standards Reference
The 4-level scheme reflects real international standards:
| Standard | What it says about classification |
|---|
| ISO/IEC 27001 (Annex A control) | Organizations must have an information classification scheme; the exact number of levels is left to the organization |
| NIST SP 800-60 / FIPS 199 | An impact-level approach: Low / Moderate / High, assessed separately for Confidentiality, Integrity and Availability |
The NIST approach is useful because one data type can matter differently for each CIA goal. For MediCare Plus’s published price list, confidentiality impact is Low (it is public anyway), but integrity impact is higher, since a tampered price list would mislead patients.
Exam tip: ISO 27001 = “you must have a scheme, you choose the levels”. NIST/FIPS 199 = “Low / Moderate / High, rated per C, I and A”. Don’t mix them up.
Classification Sets the Access Control Level
Classification is what connects data to the controls from Week 6. The higher the level, the stronger the access control.
| Level | Fitting access control (Week 6 tools) |
|---|
| Restricted (patient treatment history) | RBAC limited to the treating team, least privilege, MFA, access logging and regular access review |
| Confidential (salary records) | RBAC limited to HR/finance, logging, MFA for remote access |
| Internal (department memo) | Staff login; no special restrictions within the organization |
| Public (price list) | No confidentiality controls needed; only protect its integrity (who may edit it) |
Public data does not need the same standard as Restricted data: applying MFA and approvals to a public price list wastes money and slows work for no benefit.
The Three States of Data
Classified data does not sit still. The same data is stored, sent and viewed, and each state carries different risks.
| State | What it means | MediCare Plus example |
|---|
| At rest | Stored: database, file server, backup | Patient database stored on the hospital server |
| In transit | Moving between systems or people | Lab result emailed to a treating doctor |
| In use | Being viewed or processed right now | Doctor viewing a chart on screen |
Diagram loads as you scroll.
Administrative Safeguards by State
This is a manager-level view: what safeguards should exist and why, not how to implement them technically.
| State | Safeguards |
|---|
| At rest | Encryption at rest (concept), secure storage policy, backup security, data masking |
| In transit | Secure transmission channels, VPN for remote access, no sensitive data over personal channels (e.g. personal LINE) |
| In use | Screen privacy filters, clean-desk policy, session auto-lock, access logging |
The choice of measures should follow Week 3’s risk/cost logic: not every state, and not every data class, needs equal investment. Spend where impact × likelihood is highest.
Common mistake: thinking encryption at rest solves everything. Encryption protects a stolen disk, but it does nothing once an authorized user has the data open on screen (in use) or emails it through a personal account (in transit). Each state needs its own safeguard.
Classification and the three states describe how data should be protected. In Thailand, a law makes much of this mandatory: the PDPA (7.3).
Worked Examples
Exercise 1
Using the 4-level framework (Public / Internal / Confidential / Restricted), classify each MediCare Plus data item and justify it:
- Posted price list for health checkups
- Internal IT department meeting notes
- Employee list with salaries
- Patient treatment and diagnosis history
Show solution ↓Hide solution ↑
Solution
For each item, apply the three criteria: impact if disclosed, legal requirements, owner expectations.
- Price list: it is already posted for the public; disclosure causes no harm; no law restricts it; the hospital wants people to see it. Public.
- IT meeting notes: meant for staff only; disclosure causes limited harm (it might reveal plans or system names, but not personal data); no special legal protection. Internal.
- Employee salaries: disclosure causes real harm to the organization (staff conflict, recruitment disadvantage) and to employees, who expect it to be private; it is personal data, but not sensitive personal data. Confidential.
- Patient treatment and diagnosis history: disclosure causes severe harm to patients (discrimination, embarrassment) and serious legal exposure, because health data is sensitive personal data under PDPA; patients strongly expect secrecy. Restricted.
Answer: 1 = Public, 2 = Internal, 3 = Confidential, 4 = Restricted.
Exercise 2
Patient treatment history is classified Restricted. Which Week 6 access controls (RBAC, MFA, least privilege) fit it? Should Public data get the same standard or a lighter one? Explain.
Show solution ↓Hide solution ↑
Solution
Step 1: Restricted means severe harm and legal exposure if disclosed, so it deserves the strongest controls:
- RBAC: only roles with a clinical need (the treating doctor and nurses) can open the record; billing sees only billing fields.
- Least privilege: each person gets the minimum access needed, for example read-only access for most staff and write access only for the treating clinician.
- MFA: a stolen password alone is not enough to open records, especially remotely.
- Supporting controls: access logging and periodic access review.
Step 2: Public data (the price list) causes no harm if disclosed, so confidentiality controls add cost without benefit. It only needs integrity protection: only authorized staff may edit it.
Answer: Restricted data should get RBAC limited to the care team, least privilege and MFA (plus logging and review); Public data needs a lighter standard, mainly protection against unauthorized changes, because classification sets the access-control level.
Exercise 3
For each case, identify the state of data (at rest / in transit / in use) and the measure that is missing:
- A doctor views lab results on an open counter screen.
- The lab emails results to the treating department internally.
- The patient database has sat on the server for 5 years with no access review.
Show solution ↓Hide solution ↑
Solution
- The data is being viewed right now, so it is in use. Anyone walking past the counter can read the screen. Missing: a screen privacy filter (and positioning screens away from the public), plus session auto-lock in case the doctor walks away.
- The data is moving between systems/people, so it is in transit. Missing: a secure transmission channel, such as encrypted internal email or the hospital’s internal results system rather than plain email, so results cannot be intercepted or misdirected.
- The data is stored, so it is at rest. Five years without review means former staff or role-changers may still have access. Missing: periodic access review under a secure storage policy (with encryption at rest and backup security as supporting measures).
Answer: 1 = in use, missing screen privacy filter / auto-lock; 2 = in transit, missing a secure transmission channel; 3 = at rest, missing periodic access review (secure storage policy).
Exercise 4
Using the NIST SP 800-60 / FIPS 199 approach, rate the Low / Moderate / High impact of MediCare Plus’s patient medical records for each of C, I and A. Then explain how this approach differs from the ISO/IEC 27001 requirement.
Show solution ↓Hide solution ↑
Solution
FIPS 199 asks, separately for each security goal, how bad would the harm be if this goal failed?
- Confidentiality: disclosure of health data causes severe harm to patients and legal exposure under PDPA. High.
- Integrity: a wrong allergy, dose or diagnosis in the record could directly harm or kill a patient. High.
- Availability: if records cannot be opened, doctors in the emergency room cannot see allergies or history, which can endanger patients. High.
Difference from ISO/IEC 27001: ISO 27001 (Annex A) only requires that the organization has an information classification scheme and leaves the number of levels to the organization (e.g. the 4-level Public to Restricted scheme). NIST/FIPS 199 prescribes three impact levels and rates them per C, I and A separately.
Answer: patient records are High for confidentiality, integrity and availability. ISO 27001 requires a classification scheme with organization-chosen levels; NIST/FIPS 199 uses Low/Moderate/High rated separately for C, I and A.
Exercise 5
A MediCare Plus radiologist works from home. She connects over the public internet to view scans, sometimes forwards images to a colleague through her personal LINE account, and leaves her laptop unlocked while she makes coffee. Identify each state of data involved and recommend one safeguard for each.
Show solution ↓Hide solution ↑
Solution
Walk through the data’s journey:
- Scans stored on the hospital server: at rest. Safeguard: encryption at rest and secure storage policy, so a copied disk or backup is unreadable.
- Scans travelling to her home over the internet: in transit. Safeguard: VPN for remote access (a secure transmission channel).
- Images forwarded through personal LINE: in transit over a personal channel the hospital cannot control. Safeguard: policy of no sensitive data over personal channels; use only approved hospital messaging.
- Images open on her unlocked laptop: in use. Safeguard: session auto-lock (and clean-desk / screen-lock habits).
Answer: at rest → encryption at rest; in transit (remote connection) → VPN; in transit (forwarding) → ban personal channels such as personal LINE; in use → session auto-lock.