How Do I Classify Data?

Visit the VCU Technology Services Data Classification Tool

What Is Data Classification?

"All Data is Not Created Equal..."

With regards to the security of information, it is important to realize that there is no such things as "one size fits all" security.  Different types of data should be secured in different ways.  Imagine if, for instance, your work or school e-mail address was subject to the same security requirements as your social security number- it would be incredibly difficult for other people to contact you, even for legitmate business!

The act of classifying data, contrary to what we might have seen on the silver screen, simply means putting the data into a category based on its sensitivity.  In particular, the following questions must be answered for successful classification:

  • Who owns the data?
  • Who should have access to the data?
  • How should such access be granted or revoked?
  • What precautions must be taken to ensure that only such authorized persons can get to the data?

Different systems in use within the University, across the Commonwealth of Virginia, throughout our nation, and around the globe.  The classification of data always originates from the owner: data owned by the United States federal government must use the classification scheme relevant there, data owned by the University must use our own classification processes (which generally work in tandem with those of the Commonwealth of Virginia), and so on.

Once you have determined who owns particular data, you may use this online tool to help you determine the data category, and obtain general information on how the data should be handled.  Please note that this tool is for informational purposes only; it is in no way intended to replace official policies or laws, or to provide legal advice.