Member Resources-APPENDIX B - Data Classification and Handling Guidelines

APPENDIX B - Data Classification and Handling Guidelines
Pdf Summary
Oakleaf’s guidelines establish four information classifications, based on sensitivity and potential harm from unauthorized disclosure:

- <strong>Restricted:</strong> Most sensitive information, often subject to legal or contractual requirements. Examples include client PII/NPI, loan-file information, and certain contracts. Exposure could cause significant harm, including regulatory or contractual violations, reputational damage, lawsuits, or competitive harm.
- <strong>Confidential:</strong> Highly valuable, sensitive business information designated internally, such as employee PII/NPI, accounting, payroll, and financial data. Disclosure could cause moderate harm.
- <strong>Private:</strong> Oakleaf-owned or entrusted information that may be shared only with authorized parties who have a business need. It is the default classification for work-related information unless stricter protection is required or public release is approved.
- <strong>Public:</strong> Information approved for general release, with no expected business harm from disclosure.

When information of different sensitivities is combined, the entire asset must receive the highest classification. Restricted, Confidential, and Private information must not be released publicly; third-party sharing requires a business need and appropriate safeguards. Information must not be moved to a format or medium with weaker protections. Exceptions require CEO and CISO approval.

NPI/PII includes a person’s name or initials combined with identifiers such as government ID, driver’s license, financial account, or electronic health information.

Handling requirements become stricter with sensitivity. <strong>Restricted</strong> data must be encrypted at rest and in transmission, cannot be stored on mobile devices or cloud services, and has tight limits on printing, copying, faxing, and third-party access. <strong>Confidential</strong> data also requires encryption at rest and for external transmission; mobile storage and faxing are prohibited, and approvals apply to printing, copying, and sharing. <strong>Private</strong> data generally requires access controls; encryption is recommended, and FTP and instant messaging are prohibited. <strong>Public</strong> data has few restrictions, though classification and release dates may need labeling.

The guidelines also specify secure disposal, labeling, mailing, access approval, and printing practices according to classification. Client-specific security requirements must also be followed.
Keywords
Restricted
Confidential
Private
Public
information classification
NPI
PII
encryption
access controls
secure disposal