Classification & Labeling Taxonomy in Contoso: Information Protection

Information Protection
Classification & Labeling Taxonomy in Contoso

The document captures the classification & labeling taxonomy which has been adopted for Contoso.
Classification "labels" & "scope" in Contoso
Labels:
 Non-Business
 Public
 General
 Confidential
 Highly Confidential
Scope: (Available only for Confidential & Highly Confidential)

 Contoso Executive and Staff (visible only to the Contoso’s Senior Leadership)
 Contoso FTE (visible to all Full-Time Employees (FTE))
 Contoso Extended (visible to FTE + non-FTE)
Impact of each label & scope
The table captures the impact of applying a label & scope:
 The first column refers to the sub/label which can be applied by you (or any end user).
 The corresponding cells captures the allowed set of recipient actions
Examples from the table below:

1. By applying the "Non-Business" label, recipients can view, forward, print, save the content. The content is not
Encrypted.
2. By applying the "Confidential \ Recipients Only" label, recipients can view, reply, print & save the content.
However, recipients cannot forward the content or remove Encryption.
3. By applying the "Confidential \ Contoso Executive and Staff" label, only members of ExecStaff & ExecDir can
view, forward, reply, print and save the content. However, only members of ExStaff can remove the Encryption - while
members of ExecDir cannot.
The recipient….
Classification Can view Can forward the Can reply to the Can print Can save Can re-
applied by content/mail? mail? mail? content/mail? content/mail? protect/remove
owner: protection
Non-Business N/A N/A N/A N/A N/A N/A
Public N/A N/A N/A N/A N/A N/A
General N/A N/A N/A N/A N/A N/A
Confidential /
Yes No Yes No Yes No
Recipients Only
Confidential / Yes (only
Yes (exstaff + Yes (exstaff + Yes (exstaff + Yes (exstaff + Yes (exstaff +
Contoso Executives members of
execdir) execdir) execdir) execdir) execdir)
and Staff exstaff)
Confidential /
Yes (Only FTE) Yes (Only FTE) Yes (Only FTE) Yes (Only FTE) Yes (Only FTE) Yes (only MS FTE)
Contoso FTE Only
Confidential / Yes (FTE + non Yes (FTE + non Yes (FTE + non Yes (FTE + non Yes (FTE + non
Yes (only MS FTE)
Contoso Extended FTE) FTE) FTE) FTE) FTE)
Confidential / Any N/A N/A N/A N/A N/A N/A
User (Audited – Not
Encrypted)
Highly Confidential /
Recipients Only
Contoso Executives Yes No Yes No Yes No
and Staff
Contoso FTE Only
Contoso Extended
Highly Confidential / N/A N/A N/A N/A N/A N/A
Any User (Audited –
Not Encrypted)
N/A = No encryption.
Use cases for each label
The section calls out some common use cases for using the different labels & sub-labels.
Non-Business Non-business data which does not belong to Contoso. Data is not encrypted and cannot be tracked or
revoked. Do not use Non-Business to classify any personal data which is collected by or which belongs to Contoso.
Such content should be classified as either Confidential or Highly Confidential. Common examples include:
1. You are a writing an email (using your work PC) to a friend and share photos from your last vacation.
2. You are planning a weekend getaway with your spouse and sharing the brochure over mail.
3. You are writing a mail requesting for updated car insurance rates
Public To be used for business data specifically prepared and approved for public consumption. Data is not Encrypted
and owners cannot track or revoke content using AIP. Common examples include:
1. Responding to a customer for an in-market product query

2. Links to publicly available blog articles, marketing videos, forum links
3. Sharing links to externally posted job links
General To be used for business data which is NOT meant for public consumption. However, this can be shared with
internal employees, business guests and external partners as needed. Data is not Encrypted and owners cannot track
or revoke content using AIP. This is default label in Contoso and common examples include:
1. Newsletter for the organization

2. NEO training content or mail
3. Sharing any non-sensitive business content
Confidential To be used on sensitive business data which could cause business harm if over-shared. Recipients (see
table above) are trusted and get full delegation rights (including the ability to remove the Encryption). Data is
protected using AIP and owners can track and revoke content. Common examples include:
1. A functional spec which can be viewed only by Contoso FTEs

2. Marketing campaign development for a new product through an external ad firm
3. A mail from Contoso 's SLT on new compliance guidance
Highly Confidential To be used on very sensitive business data which would certainly cause business harm if over-
shared. Recipients (see table above) do NOT get delegation rights (or rights to modify or remove the Encryption). Data
is protected using AIP and owners can track and revoke content. Common examples include:
1. Contact your HR with a sensitive concern

2. A mail from SLT on the upcoming quarterly performance and guidance
3. List of potential candidates for Cxx position to the board of directors
4. Sharing next-gen feature prep work which includes customer profile details
Support
 Contact global helpdesk from http://Link
Contoso Classification
Examples
Highly Confidential
Examples of data commonly classified as Highly Confidential include but is not limited to:
· Contoso pre-release financial results

· Data used for authenticating or validating a person’s identity; or other information that can be used to directly
or indirectly “authenticate and authorize” Contoso high-value transactions
· Data under strict regulatory handling requirements (i.e. where the legal or regulatory body specifies the
handling requirements for the data)
Confidential Data
Examples of data commonly classified as Confidential include but is not limited to:
· Product documentation and supporting materials

· Non-Highly Confidential data that is subject to breach notification laws (e.g., personnel number, personal
contact information)
· Non-Highly Confidential Human Resources data
· Data about Contoso employees, such as title or current role
General Data
Represents our daily work product used and shared throughout Contoso. Data classified as
Examples of data commonly classified as General include but is not limited to:
· Commonly shared (internal) information, including operating procedures, policies and interoffice
memorandums
· Companywide announcements and information that all employees, contingent staff, and those under NDA
have been approved to read
Public Data
Examples of data commonly classified as Public include but is not limited to:
· Marketing materials created for public product releases

· Published financial information
· Materials used for presentations at open conferences, seminars, and podcasts
Non-business Data
Examples of data commonly classified as Non-business include but is not limited to:
 Your personal emails to family, friends and colleagues not related to Contoso business activities (e.g. lunch
invitation)
 Flyer sharing children’s summer camp information (not a Contoso sponsored event)
 Individual non-Contoso data, such as your tax filing

Classification & Labeling Taxonomy in Contoso: Information Protection

Uploaded by

Copyright:

Available Formats

Classification & Labeling Taxonomy in Contoso: Information Protection

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Classification & Labeling Taxonomy in Contoso: Information Protection

Uploaded by

Copyright:

Available Formats

Information Protection

Classification & Labeling Taxonomy in Contoso

Classification "labels" & "scope" in Contoso

Scope: (Available only for Confidential & Highly Confidential)

Examples from the table below:

1. Responding to a customer for an in-market product query

1. Newsletter for the organization

1. A functional spec which can be viewed only by Contoso FTEs

1. Contact your HR with a sensitive concern

· Contoso pre-release financial results

· Product documentation and supporting materials

· Marketing materials created for public product releases

You might also like