What is data classification and how should a TA apply it to access control and protection measures?

• A. Classify data by sensitivity (public, internal, confidential, restricted); enforce controls based on classification; apply encryption, access restrictions, and retention policies accordingly.
• B. Classification has no impact on access control.
• C. Only encryption matters.
• D. Retention policies are not needed.

Answer: (A)

Data classification is the process of labeling data by its sensitivity and importance so that you can match protections to the level of risk it poses. A trusted agent applies this by defining clear levels (for example: public, internal, confidential, restricted) and then tying each level to specific access controls and protection measures. For less sensitive data, lighter controls may suffice, but for more sensitive data you implement stronger protections: need-to-know access, least-privilege access, multi-factor authentication, and strict access enforcement. Protection measures are layered, including encryption for data at rest and in transit, proper key management, and robust monitoring.

Retention policies are also aligned with classification, ensuring data is kept only as long as needed for legal, regulatory, or business reasons and disposed of securely when no longer required. This classification-driven approach keeps protections proportional to risk and ensures resources are focused where they matter most. Relying only on encryption, or treating classification as irrelevant, misses the way protections should be scaled to data sensitivity and lifecycle needs.