Winging It · Implausible Deniability
Every data classification scheme I've ever seen was born in the same workshop, from the same consultant's template, which has four tiers, so the scheme has four tiers: Public, Internal, Confidential, and Restricted. I've never met anyone that can explain how the last two differ.
The definitions for these get written anyway, put together at 3pm on a Friday afternoon. Confidential turns out to be information whose disclosure could cause damage to the organisation, while Restricted is information whose disclosure could cause serious damage to the organisation. The entire classification scheme now rests on the word "serious", to be interpreted unsupervised, in the moment, by every employee who will never read this document.
The handling rules come next: Restricted must be encrypted at rest, stored in approved systems, shared strictly need-to-know and never printed, which is convenient, because nobody will ever mark anything Restricted. The classification matrix always seems to get laminated and pinned up beside the printer, next to a poster about clear desk policy. The policy takes a quarter to go through approval without amendment, and months later an auditor confirms it maps neatly to control 5.12, the main thing it will ever be asked to do.
Then the scheme meets the organisation.
I've read a lot of corporate documents over the years, and the four tiers appear on approximately none of them. What appears instead, on presentations, RFPs, pricing sheets and board papers and the occasional catering quote, is a phrase from outside the policy altogether. Commercial in Confidence. It's on the org chart the week before a restructure. It's on a salary spreadsheet with the tab named Salaries. The people typing it in bold and centring it couldn't recite one of the four tiers at gunpoint, and they apply it to material ranging from market-sensitive to a seating plan.
The training budget goes on the four tiers, and everyone finishes the module and goes back to writing Commercial in Confidence, the one label with no definition, no handling rules and no home in any policy, applied with total consistency.
The email system, meanwhile, has appended a Commercial in Confidence disclaimer to every message since about 2009, including replies that say "thanks" and the all-staff email about people putting their mugs in the dishwasher.
Why that phrase, though? Partly down to procurement, because it comes out of RFPs, where it means something contractual, and sounds official. Confidential is a state, while Commercial in Confidence is a sentence with people in it.
Whoever marks a document Commercial in Confidence is addressing a person. I'm confiding in you, and there are consequences for us both if this leaks.
ISO 27001 never asked for four tiers. Control 5.12 asks that information be classified by legal requirement, value, criticality and sensitivity, and says nothing about how many labels that takes. The standard four came from the consultant's template, which imitated government marking schemes, and more than one government has since deleted entire tiers from its own scheme, CONFIDENTIAL among the casualties, and nothing broke, which is in itself amazing for a government. A scheme people would use has two labels. The default, and the short list of things that end careers, with real handling rules on the second and a definition a person can apply in the four seconds they're prepared to give it. Your DLP vendor will object, your general counsel will definitely object, and the person doing privacy mapping will have a case. I'd still take a scheme people use over one people simply admire.
The certification cycle turns regardless, documents getting sampled for markings, and one reliable hit comes back, year after year: the Information Classification Policy itself, correctly marked Internal by the consultant. The certificate renews on the strength of it.
Out in the business, someone is typing Commercial in Confidence onto a catering quote. Unpaid, untrained and unsupervised, they are the entire working part of the classification system. The next audit should start by asking them what they think the phrase means. I imagine their answer will be better than the policy.
— Chris