Info
Content

Data Classifications

Name

KS Data Classifications

Owner

KS Corporate/KS IT/KS InfoSec

Issue Date

June 2019

Classification

Public

This document contains the mappings to HMG Classifications scheme, OFFICIAL, SECERT and TOP SECRET.

Because all HMG information falls in to the OFFICAL classification by default if it has not been given a higher classification, this means that it can contain a range of sensitive or public material. As such OFFICAL information should by handled in the same way as KS’s INTERNAL classification. Information marked as OFFICAL and caveated SENSITIVE should be handled in the same way as KS’s SENSTIVE classification

KS Systems are not secured to the correct standard to process SECERT or TOP SECERT information.

Failure to comply with this procedure could result in action in line with KS’s disciplinary procedure.

Annex A – Classifications

Classification

PUBLIC

INTERNAL

SENSITIVE

Definition

Information that is intended for public distribution and requires no specific security handling.

Information relating to routine business operations and services, where it is prudent to maintain a need-to-know approach. This covers the majority of KS-generated information.

Information that has a clear elevated sensitivity due to its legal, contractual or business value.

Impact if compromised

Minimal or no risk to our operations, service delivery or reputation.

 

No discomfort or embarrassment to individuals.

 

No breach of statutory obligations.

Minor reputational risk

 

Technical breach of duty of confidence

 

Possible breach of statutory obligation

 

Short-term discomfort or embarrassment to an individual

 

Commercial disadvantage or loss

 

Short-term disruption to our operations and services

Serious reputational risk

 

Danger to personal safety

 

Major breach of statutory obligation

 

Prolonged distress, discomfort or embarrassment to an individual.

 

Distress, discomfort or embarrassment to a group of individuals

 

Serious commercial disadvantage or loss, including financial or legal penalties

 

Long-term disruption to our operations and services

Examples

Marketing material

 

Published information on public websites

 

Vacancy details

 

Anonymized statistical information

 

Any information already disclosed under the Freedom of Information Act 200.

Internal correspondence

 

Policies and procedures

 

Working documents

 

Personal data on staff and clients but not meeting the GDPR definition for Special Category Data

Staff passwords for KS devices and systems

 

Administrator passwords for KS devices and systems

 

Client usernames and passwords

 

Client data

 

Information relating to ongoing commercial or research projects where disclosure could jeopardize the project

 

Financial information defined as commercial-in-confidence

 

Special Category Data as defined in foot note [1]

 

Information covered by The Official Secrets Act 1989.

Annex B – Handling requirements

Classification

PUBLIC

INTERNAL

SENSITIVE

Access

Intended for public distribution, although embargoes may apply prior to publication

Available to any authenticated KS member (.e.g with Login Access)

Available only to specified authenticated KS members, with login access and additional authorization.

Labelling

Internal copies should be visibly marked ‘PUBLIC’

There is no requirement to visibly mark.

All copies should be visibly marked ‘SENSTIVE’

 

Reference the classification in the subject line and or text of email communications.

Storage

Primary copy on KS Network Drive or KS Systems

Primary copy on KS Systems

 

When possible should be kept on KS Systems.

 

Store physical assets securely when not in use. Lock IT equipment when unattended

 

 

Data covered by the GDPR should remain as far as possible in the appropriate KS systems. Where downloaded or otherwise this should be done on KS drives (personal or shared).

 

Can keep on KS laptops, if encrypted/password protected, and taking care to avoid loss and theft.

 

KS SENSITIVE data should not be stored on personal devices.

Communications

Can email without encryption or password protection.

 

Can be sent in the standard mail.

The use of encryption or password protection should considered, but is not mandated. Extra consideration should be given to encryption of KS staff data, bank account details etc are being transferred in large numbers.

 

Can be sent in the standard mail, but for large data sets Royal Mail Signed for should be considered.

Not to be communicated externally expect in defined circumstances. E.g. pre-agreed data sharing, police investigation.

 

Authorized staff should email with encryption or use another mechanism

 

When discussing in public or by telephone, appropriate discretion should be exercised. Details of sensitive material should be kept to a minimum.

 

Should only be posted using Royal Main signed For or equivalent.

Sharing

Intended for public distribution, although embargoes may apply prior to publication.

Can share for business purpose, maintaining a need-to-know approach.

 

Can share via KS network drives, OneDrive, SharePoint and on authenticated website.

Internal distribution should be according to a strict application of the need to know principle. Where there is a reason to share selected or general information from a SENSITIVE report more widely, originators should develop a version at INTERNAL or PUBLICE where possible.

 

Can be shared via KS network drives, OneDrive or SharePoint as long as access is appropriately restricted.

 

Particular care should be taken when sharing information with external partner or the public; for example, emails and letters should only be sent to named recipients at the known addresses where there is an agreed business need to share (which may be supported by a data sharing agreement)

Destruction

No restrictions

Information is not freely available in the public domain should be destroyed in a way that makes reconstitution unlikely.

Information should be destroyed in a way that makes reconstitution difficult. For example, paper files should be shredded. Electronic devices should be wiped or destroyed according to IAS5 or equivalent.

Remote Access

Can be held on public website or authenticated systems.

Can be held on systems accessible via authenticated web service or VPN access.

Should only be held on systems requiring VPN access.

Off-site working

No restrictions

Physical assets should be protected in transit, not left unattended, and stored securely. Precautions should be taken to prevent overlooking or inadvertent access when working remotely or in public places.

Removal of physical assets should be confirmed with the asset owner. Physical assets should be protected in transit, not left unattended, and stored securely. Precautions should be taken to prevent overlooking or inadvertent access when working remotely or in public places.

[1] Sensitive personal data is personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation; and  the commission or alleged commission by them of any criminal convictions or offence, or any proceedings for any offence committed or alleged to have been committed by them, the disposal of such proceedings or the sentence of any court in such proceedings.

Back to top