Back to Assessments & Documents
Data and Analytics Active

Data Classification and Handling Maturity Assessment

A 53-question diagnostic across 6 domains that evaluates whether the organization knows where its sensitive data is and whether each label drives how that data is protected, shared and used by AI: governance and taxonomy...

Start Assessment

Overview

A 53-question diagnostic across 6 domains that evaluates whether the organization knows where its sensitive data is and whether each label drives how that data is protected, shared and used by AI: governance and taxonomy, discovery and inventory, labeling, handling and protection by level, cloud, SaaS and AI platforms, and reclassification and monitoring. Written for the CISO or head of information governance who needs to answer: do we know where our sensitive data is, and does its label drive how it is protected, shared and used by AI?

Detailed Description

Most organizations have a classification policy; far fewer can show that labels are applied consistently, that protection actually changes with the label, or that AI assistants and agents respect it. This assessment tests the full chain: a policy and a standard that set levels by business impact, owner approval and a usable decision guide, discovery that finds sensitive data across databases, files, cloud and SaaS, labels applied at creation, inherited by derived data and raised when data is combined, a handling matrix that sets what each level requires, and enforcement through access, DLP, encryption, masking, sharing, export and API controls. It gives particular weight to AI: data sets classified before training or retrieval, assistants and agents limited by label, AI-generated content marked, and labels following data into vector stores and agent memory. It is a deep dive in the ITSG data family and replaces Data Classification and Lifecycle v8.9.5. Retention, legal hold, archives and destruction now belong to Records and Information Management, residency to Privacy Program Operations and sharing agreements to Data Products and Data Sharing; this model tests those hand-offs only. The model is neutral to jurisdiction and vendor: laws and national classification schemes are mapped through the External Scheme Crosswalk by regional overlay models.

Assessment Details

Audience

Primary: CISO, head of information governance and the classification program lead. Secondary: data owners, information security and DLP teams, IT, cloud and application owners, AI and analytics platform owners, legal, privacy and compliance, and internal audit.

Purpose

Shows where classification exists only on paper, where sensitive data is unknown or unlabeled, and where protection does not follow the label, including in AI tools. Gives the CISO and information governance a prioritized roadmap and gives DLP, privacy, records and AI teams a dependable label to build on.

Effort

Initial assessment: 10 to 12 hours of facilitated sessions over two weeks with information governance, information security and DLP, two or three data owners, IT and cloud platform owners, AI platform owners and legal, starting with a 30-minute session with every area for the four all-area questions. Evidence gathering: the policy, standard, handling standard, program plan, inventory and discovery results, rule set, samples of labeled content and AI data sets, access and DLP rule extracts and performance reports. Reassessment: 5 to 6 hours.

Cadence

Annually, and after a new discovery or labeling platform, a major cloud or SaaS adoption, the rollout of AI assistants or agents over company data, a significant data incident or a change in the classification schemes the organization must follow.

Framework Alignment

ISO/IEC 27001:2022 NIST SP 800-53 Rev 5 NIST SP 800-60 Vol. 1 Rev. 1 NIST CSF 2.0 COBIT 2019 NIST FIPS 203 NIST SP 800-88 Rev 2 ISO/IEC 42001:2023 NIST AI 100-4 C2PA Technical Specification 2.4 OWASP Top 10 for Agentic Applications 2026

KPIs

  • Stores Scanned on Cycle - Share of in-scope data stores scanned within their defined discovery cycle. Target: at least 95%.
  • Label Accuracy - Share of sampled items carrying the correct classification. Target: at least 95%.
  • High-Level Stores Encrypted to Standard - Share of stores holding the two highest levels encrypted to the standard for their level. Target: 100%.
  • AI Data Sets Classified - Share of AI training, fine-tuning and retrieval data sets with a recorded classification before use. Target: 100%.
  • Overrides Reviewed on Time - Share of label downgrades and removals reviewed within five business days. Target: 100%.

Dependencies

Data Governance and Management (v1.9.6): owns the Data Management Policy, Data Ownership Register and Data Obligations Register; owners approve levels here and regulated categories come from the obligations register (1.1, 1.3, 1.6). Metadata, Catalog and Lineage (v1.9.6): shows classification tags on catalog assets and provides lineage for sensitive data flows (2.6, 3.05). Data Loss Prevention Operations (v8.9.6): owns the DLP Rule Catalog and Insider Risk Monitoring Standard and enforces labels at egress; this model tests the hand-off (4.03, 4.10, 6.7). Master Data and Data Quality Management (v6.9.6) and Shadow AI Sprawl Governance (v3.9.6): use the Data Classification Standard owned here. Security Operations (v8.9.6), API and Integration Lifecycle (v6.9.6), AI Governance (v11.9.6), Configuration Management (v9.9.6) and IT Asset Management (v6.9.6): own the incident standard, API design rules, AI data set and agent standards, CMDB and cloud and SaaS standard used here (6.6, 5.3, 5.5, 5.6, 2.5, 2.4). Records and Information Management (v1.9.6), Privacy Program Operations (v1.9.6) and Data Products and Data Sharing (v1.9.6): own retention and destruction, residency rules and sharing agreements; this model tests the hand-offs only (6.3, 5.4, 4.06). Recommended: Run after Data Governance and Management; run before Data Loss Prevention Operations, Privacy Program Operations and any rollout of AI assistants or agents over company data.

Assessment Outline

(6 domains · 53 questions)
  1. 1

    1 Classification Governance and Taxonomy

    Classification policy, the classification standard and impact method, owner approval, program plan, decision guide, regulated categories, external scheme mapping, exceptions, training

    • 1.1 Data Classification Policy 1 questions
    • 1.2 Classification Standard and Impact Method 1 questions
    • 1.3 Owner Classification Approval 1 questions
    • 1.4 Classification Program Plan 1 questions
    • 1.5 Decision Guide 1 questions
    • 1.6 Regulated Data Categories 1 questions
    • 1.7 External Scheme Mapping 1 questions
    • 1.8 Classification Exceptions 1 questions
    • 1.9 Awareness and Training 1 questions
  2. 2

    2 Sensitive Data Discovery and Inventory

    Automated discovery, structured data, dark data, cloud and SaaS scope, asset links, sensitive data flows, risk concentration

    • 2.1 Continuous Sensitive Data Discovery 1 questions
    • 2.2 Structured Data Discovery 1 questions
    • 2.3 Dark Data Discovery 1 questions
    • 2.4 Cloud and SaaS Discovery Scope 1 questions
    • 2.5 Asset Inventory Integration 1 questions
    • 2.6 Sensitive Data Flow Mapping 1 questions
    • 2.7 Sensitive Data Concentration 1 questions
  3. 3

    3 Classification and Labeling

    Labeling at creation, automated inspection, marking, override control, structured data, collaboration, inbound data, derived data, aggregation, AI-generated content, legacy remediation

    • 3.01 Labeling at Creation 1 questions
    • 3.02 Automated Content Inspection 1 questions
    • 3.03 Visual and Metadata Marking 1 questions
    • 3.04 Label Override Control 1 questions
    • 3.05 Structured Data Labeling 1 questions
    • 3.06 Email and Collaboration Labeling 1 questions
    • 3.07 Inbound Data Classification 1 questions
    • 3.08 Derived Data Label Inheritance 1 questions
    • 3.09 Aggregation Uplift 1 questions
    • 3.10 AI-Generated Content Marking 1 questions
    • 3.11 Legacy Data Remediation 1 questions
  4. 4

    4 Handling and Protection by Level

    Handling matrix, access by level, DLP hand-off, encryption, quantum-safe protection, sharing, publication, physical media, masking, bulk export, export-controlled data

    • 4.01 Data Handling Standard 1 questions
    • 4.02 Access by Classification Level 1 questions
    • 4.03 Label-Driven DLP Hand-off 1 questions
    • 4.04 Encryption by Classification Level 1 questions
    • 4.05 Quantum-Safe Protection for Long-Lived Data 1 questions
    • 4.06 Sharing Controls by Level 1 questions
    • 4.07 Publication and Open Data Release 1 questions
    • 4.08 Physical Media Handling 1 questions
    • 4.09 Masking in Non-Production 1 questions
    • 4.10 Bulk Download and Export Control 1 questions
    • 4.11 Export-Controlled Technical Data 1 questions
  5. 5

    5 Cloud, SaaS and AI Platforms

    Cloud baseline, SaaS labels, API enforcement, location rules by level, AI dataset classification, AI assistant and agent access

    • 5.1 Cloud-Native Label Enforcement 1 questions
    • 5.2 SaaS Data Classification 1 questions
    • 5.3 API Data Label Enforcement 1 questions
    • 5.4 Location Rules by Level 1 questions
    • 5.5 AI Dataset Classification 1 questions
    • 5.6 AI Assistant and Agent Data Access 1 questions
  6. 6

    6 Reclassification, Monitoring and Improvement

    Reclassification and downgrade, label propagation to AI copies, retention hand-off, compliance monitoring, accuracy audit, incident triage, behavior monitoring, tool tuning, program reporting

    • 6.1 Reclassification and Downgrading 1 questions
    • 6.2 Label Propagation to AI Copies 1 questions
    • 6.3 Retention and Disposal Hand-off 1 questions
    • 6.4 Classification Compliance Monitoring 1 questions
    • 6.5 Label Accuracy Audit 1 questions
    • 6.6 Label-Informed Incident Triage 1 questions
    • 6.7 Behavior Monitoring for Classified Data 1 questions
    • 6.8 Classification Tool Tuning 1 questions
    • 6.9 Program Reporting and Improvement 1 questions

At a Glance

Category Data and Analytics
Type Free
Roles 6
Domains 6
Questions 53
Start Assessment

Still have questions? Get in touch

ITSGovernance
  • Twitter

Contact us

ITSGovernance