Royal Army College

Lesson Overview

You cannot protect everything equally, and you should not try. A state's data ranges from the freely public to the gravely sensitive, and treating it all the same wastes protection on what does not need it while under-protecting what does, so the first step in securing data well is to know what you have and how sensitive it is, which is data classification. And data is not static: it is created, used, kept, and eventually disposed of, a lifecycle through which its handling must be managed, including the often-neglected end, secure disposal, because data kept forever or thrown away carelessly is a standing risk. This lesson is about both: classifying data by its sensitivity so protection can be matched to need, and managing data through its whole lifecycle from creation to secure destruction. It deepens the records and data security of Lesson 05 into the disciplines of knowing what you hold, how sensitive it is, and what should happen to it over time.

Two ideas govern the lesson. The first is that protection follows classification: you protect data according to how sensitive it is, which you can only do if you have classified it. Without classification, a force either over-protects everything (wasteful and impractical) or, far more commonly, under-protects the sensitive because it is mixed in with the mundane and not recognised as needing more; with classification, the gravely sensitive gets strong protection, the public gets little, and each is handled as its sensitivity warrants. The second is that data has a lifecycle, and the end of it matters as much as the rest: data that is kept long after it is needed is a growing liability (more to lose, more to leak), and data disposed of carelessly can be recovered by others, so managing retention and ensuring secure destruction are as much a part of data security as protecting data in use. Together, classification and lifecycle management let a force protect the right data the right amount for the right time, which is what proportionate, sustainable data security requires.

This is the knowledge layer; the practice of classifying and managing a state's data is done under those responsible for its records, with access following appointment. It rests on recognised data-classification and data-lifecycle practice and the principles of records management, and is wholly defensive. Read this to understand the disciplines; the practice comes under guidance.

By the end you will be able to explain why protection must follow classification, classify data by sensitivity into useful levels, manage data through its lifecycle from creation to use to disposal, apply retention and secure-destruction discipline, and match handling to classification throughout.

Key Terms

Data classification: the sorting of data by how sensitive it is, so that protection and handling can be matched to its sensitivity.
Classification level: a defined category of sensitivity (for example public, internal, confidential, restricted) with handling rules attached.
Sensitivity: how much harm the exposure, loss, or alteration of data would cause, which determines how strongly it must be protected.
Handling rules: the requirements for storing, sharing, transmitting, and disposing of data at a given classification level.
Data lifecycle: the stages data passes through, creation, use, retention, and disposal, each of which must be managed.
Retention: the keeping of data for as long as it is needed and required, and no longer; over-retention is a liability and under-retention loses needed records.
Disposal (destruction): the secure, permanent removal of data at the end of its life, so it cannot be recovered by others.
Secure destruction: disposal done so that the data is genuinely unrecoverable, not merely deleted in a way that leaves it retrievable.
Data minimisation: holding only the data genuinely needed, for as long as needed, so there is less to protect and to lose (a principle shared with privacy).
Over-retention: keeping data beyond its need or requirement, which accumulates risk because there is more to leak, lose, or have to protect.

Why protection must follow classification

The case for classification begins with a plain impossibility: a force cannot protect all its data to the highest standard, because the highest protection is costly in effort, friction, and resources, and applying it to everything, the public notices alongside the gravely sensitive records, would be wasteful and unsustainable. Nor should it, because most data does not need the highest protection. The alternative to over-protecting everything is to match protection to sensitivity, protecting the sensitive strongly and the mundane lightly, but this requires knowing which data is which, which is exactly what classification provides. Without classification, a force cannot match protection to sensitivity, because it does not know, in any organised way, what is sensitive; with it, it can.

The greater danger of not classifying is not waste but under-protection of the sensitive. When data is not classified, the gravely sensitive, a register of nationals' personal data, a secret key, a confidential record, sits mixed in with the mundane, unrecognised as needing more, and is therefore protected only to the general standard, which for sensitive data is not enough. The compromise that exposes a state's most sensitive data is very often one where that data was not identified as specially sensitive and so was not specially protected, handled with the same casualness as ordinary information because no one had marked it as different. Classification prevents this by identifying the sensitive so it can be specially protected, which is its chief security value: it ensures the data that most needs strong protection is recognised and gets it, rather than being lost in the mass.

So protection follows classification: you decide how sensitive each kind of data is, and you protect it accordingly, strongly for the sensitive, lightly for the public, proportionately in between. This is the foundation of sustainable, proportionate data security, and it is why classification comes first: until you know what you have and how sensitive it is, you cannot protect it well, only uniformly (which over-protects some and under-protects the rest) or haphazardly (which under-protects whatever is not noticed). The member who classifies the data they handle, recognising the sensitive and marking it as such, makes proportionate protection possible; one who treats all data alike either wastes effort or, far worse, leaves the sensitive exposed among the mundane.

Classifying data by sensitivity

To classify data usefully, a force defines a small set of classification levels by sensitivity, with handling rules attached to each, and sorts its data among them. The number of levels is kept small and practical, because a scheme too elaborate is not used; a few clear levels that people can actually apply are far better than many fine gradations that confuse. A typical, workable scheme has levels running from the least to the most sensitive, for example: public (data that may be freely shared, the website, published notices), internal (data for the force's own use but not gravely sensitive), confidential (sensitive data whose exposure would do real harm, many records and personal data), and restricted (the most sensitive, whose exposure would do grave harm, secret keys, the most sensitive personal or state data). The exact levels and names a force uses are its own choice; what matters is a small, clear set of levels distinguished by how much harm exposure would cause.

The basis of classification is how much harm the exposure, loss, or alteration of the data would cause, which is its sensitivity. Data whose exposure would do grave harm, to a national's safety or privacy, to the state's security, to the integrity of its records, is classified high and protected strongly; data whose exposure would do little harm is classified low and protected lightly. Classifying a piece of data is thus a judgement of consequence: what would it cost if this were exposed, lost, or altered? The answer places it on the scale and determines its handling. For a digital state holding the personal data of its nationals and the records that constitute its statehood, much data is genuinely sensitive, which makes honest classification, not under-classifying sensitive data for convenience, especially important.

To each level attach handling rules: the requirements for storing, sharing, transmitting, and disposing of data at that level, so that classification translates into action. Restricted data might require encryption, the strictest access control, and secure transmission and destruction; public data might require none of these. The handling rules are what make classification useful rather than merely descriptive: they say, for each level, how the data must be handled, so that a person who knows a piece of data's classification knows how to treat it. Classification with handling rules thus gives the force a system: data is sorted by sensitivity into a few clear levels, each with rules that match protection to that sensitivity, so the right data gets the right protection as a matter of course. The member classifies the data they handle and applies the handling rules for its level, which is how proportionate protection actually happens.

   DATA CLASSIFICATION  (protection follows sensitivity)

   LEVEL (example)   SENSITIVITY (harm if exposed)   HANDLING (matched)
   ---------------   ----------------------------    -------------------
   PUBLIC            none/little                     freely shareable
   INTERNAL          some                            for our own use
   CONFIDENTIAL      real harm                        access-controlled,
                     (records, personal data)         protected, careful sharing
   RESTRICTED        grave harm (keys, most           strongest: encryption,
                     sensitive personal/state data)   strictest access, secure
                                                       transmission + destruction

   Keep the levels FEW and CLEAR (a usable scheme beats a fine-grained one).
   Classify by CONSEQUENCE: what would exposure/loss/alteration cost?
   Then apply the HANDLING RULES for the level -> proportionate protection.

The data lifecycle: creation to disposal

Data is not static; it passes through a lifecycle, and managing data security means managing it at every stage, not just protecting it in use. The stages are creation, when data comes into being and should be classified from the start; use, when it is accessed and worked with, protected and access-controlled per its classification; retention, when it is kept for as long as it is needed; and disposal, when it is securely destroyed at the end of its life. Each stage has its discipline, and a gap at any stage is a security gap: data unclassified at creation may be mishandled throughout; data over-retained becomes a growing liability; data disposed of carelessly is recoverable by others. Securing data means managing the whole lifecycle, and the often-neglected stages, retention and disposal, are where much of the avoidable risk lies.

Retention is the keeping of data for as long as it is needed and required, and no longer, and getting it right cuts both ways. Keep too little, dispose of data still needed or legally required, and the force loses records it must have. But the commoner and more dangerous error is over-retention: keeping data long after it is needed, out of habit, neglect, or a vague sense that it might be useful, which steadily accumulates risk, because every piece of data retained is something more to protect, to leak, to lose, or to have stolen. A force that keeps everything forever holds an ever-growing hoard of sensitive data, much of it no longer needed, all of it a liability; one that retains data only as long as needed and required, and disposes of it after, holds less and so risks less. This connects to data minimisation, the principle, shared with privacy, of holding only the data genuinely needed for as long as needed: the less data held, the less there is to protect and to lose, so disciplined retention, keeping only what is needed for only as long as needed, is itself a security measure.

The end of the lifecycle, disposal, is where a specific and often-missed danger lies, and it has its own section because it is so commonly done badly.

Disposal and matching handling to classification

Disposal means the secure, permanent removal of data at the end of its life, and the crucial point is that deleting data is not the same as destroying it. Data "deleted" in the ordinary way is often not actually gone; it may remain recoverable on the storage, in backups, in copies, retrievable by someone with the means and motive, so a force that "deletes" sensitive data and considers it disposed of may in fact have left it recoverable. Secure destruction is disposal done so that the data is genuinely unrecoverable, by the proper means for the medium (secure erasure, destruction of the storage, proper handling of all copies and backups), so that disposed-of data is truly gone and cannot be recovered by others. For sensitive data especially, secure destruction at end of life is essential, because data that has served its purpose and is no longer needed is pure liability, and disposing of it insecurely, leaving it recoverable, throws away the protection it had while removing it from active management. The discipline is to destroy securely what is no longer needed, so it cannot come back to harm.

Through the whole lifecycle runs the principle the lesson opened with: handling matches classification at every stage. Data is classified at creation; protected in use per its classification; retained per its classification and need; and disposed of per its classification, the most sensitive requiring the most thorough secure destruction. The handling rules of each classification level cover the whole lifecycle, not just storage, so that a piece of restricted data is created carefully, used under strict access, retained only as needed, and destroyed beyond recovery, while public data is handled lightly throughout. This is the system the lesson builds: classification telling you how sensitive data is, the lifecycle telling you what stage it is at, and the handling rules telling you how to treat it given both. The member who classifies data, manages it through its lifecycle, retains it only as needed, and destroys it securely at the end, handling it per its classification at every stage, secures the force's data proportionately and sustainably, which is what data classification and lifecycle management are for. And this discipline underpins the protection of nationals' privacy that the next lesson takes up, because much of privacy is exactly this: classifying personal data as sensitive, holding only what is needed for only as long as needed, and destroying it securely when done.

In Practice: The Right Protection for the Right Data

A member of the Royal Kaharagian Army responsible for records studies how the Principality's data is classified and managed through its life, and sees that the aim is proportionate, sustainable protection: strong where it is needed, light where it is not, and managed from creation to secure destruction. A careless approach would treat all data alike, over-protecting the trivial while the sensitive sits unrecognised among it, and keep everything forever, deleting carelessly when pressed; the disciplined approach classifies and manages the lifecycle.

Data is classified at creation into a few clear levels by sensitivity, judged by the harm its exposure would cause: the public notices freely shareable; the internal data for the force's use; the confidential records and personal data whose exposure would do real harm; and the restricted secret keys and most sensitive data whose exposure would do grave harm. To each level are attached handling rules, so the restricted data gets encryption, strictest access, and secure transmission and destruction, while the public gets none of these, and protection follows classification: the sensitive is recognised and strongly protected rather than lost among the mundane, which is the chief security value of classifying at all.

Through the lifecycle, the member manages each stage: data classified at creation, protected in use per its classification, retained only as long as needed and required, not hoarded forever, because over-retention accumulates risk, and, at end of life, securely destroyed, genuinely unrecoverable, not merely "deleted" in a way that leaves it retrievable, including its copies and backups. Handling matches classification at every stage, so a piece of restricted personal data is created carefully, used under strict access, retained only as needed, and destroyed beyond recovery. The result is data security that is proportionate, the right protection for the right data, and sustainable, only what is needed kept for only as long as needed, which a small force can actually maintain. The sensitive is strongly guarded because it was classified and recognised; the force holds less because it retains and disposes with discipline; and nothing is left recoverable in careless deletion. That is data classification and lifecycle management, and it is the foundation of the privacy of nationals the next lesson protects.

Check Your Understanding

Explain why "protection must follow classification," why a force cannot protect all data equally, and why the chief danger of not classifying is the under-protection of the sensitive (lost among the mundane), not just wasted effort.
Describe how data is classified into a few clear levels by sensitivity (the harm exposure would cause), with handling rules attached to each, and why the scheme is kept small and clear. On what basis is a piece of data placed on the scale?
Set out the data lifecycle (creation, use, retention, disposal), the discipline of retention (only as long as needed, the danger of over-retention, the link to data minimisation), and why secure destruction matters (deleting is not destroying; disposed-of sensitive data must be genuinely unrecoverable).

Reflection (write a short paragraph): This lesson argues that the commonest and most dangerous failure is not over-protecting trivia but under-protecting the sensitive because it sits unrecognised among the mundane, and that over-retention quietly accumulates risk because every piece of data kept is something more to lose. Think about data you or an organisation you know holds: is the genuinely sensitive recognised and specially protected, or mixed in and treated the same as everything else, and is old data kept long past its need "just in case"? Why is classifying data and disposing of it securely when done a security discipline and not just tidiness?

Summary

A force cannot and should not protect all data equally, so protection must follow classification: you protect data according to its sensitivity, which requires knowing what you hold and how sensitive it is. The chief danger of not classifying is the under-protection of the sensitive, which sits unrecognised among the mundane and is handled with the same casualness, the cause of many serious exposures.
Classify data into a few clear levels (for example public, internal, confidential, restricted) by sensitivity, the harm its exposure, loss, or alteration would cause, with handling rules attached to each level. Keep the scheme small and usable; classify by consequence; honest classification matters especially for a digital state holding much genuinely sensitive data.
Data has a lifecycle, creation (classify from the start), use (protect per classification), retention (keep only as long as needed and required), and disposal. Over-retention accumulates risk (more to leak and lose), so disciplined retention and data minimisation (hold only what is needed) are themselves security measures.
Disposal must be secure destruction: deleting is not destroying, "deleted" data is often still recoverable, so sensitive data is disposed of so it is genuinely unrecoverable (including copies and backups). Throughout, handling matches classification at every stage.
This is the knowledge layer; classifying and managing a state's data is done under those responsible for its records, with access following appointment. The lesson deepens the records and data security of Lesson 05, applies the minimisation principle, and underpins the privacy of nationals in Lesson 09 (classify personal data as sensitive, hold only what is needed for only as long as needed, destroy securely). Everything here is defensive.

Data Classification and the Data Lifecycle