Data Classification Sorter

The instinct this activity is built to correct is treating classification as a feeling about how secret something sounds. It is not — it is a question about consequence: if this item appeared on the open internet tomorrow morning, what actually happens? Public means the answer is "nothing, we published it on purpose." Internal means "embarrassing and unhelpful, but survivable" — the item is for everyone inside and no one outside. Confidential means real harm to the business or to a named person, so access is granted deliberately rather than by default. Restricted is the tier where the harm is legal or regulatory rather than merely commercial, and the controls tighten accordingly. Run the consequence test on each card and most of the hard ones resolve themselves. The traps here mostly punish the feeling-based instinct. The office Wi-Fi password is the sharpest one: it is a password, and passwords feel maximally secret, but it was handed to every employee in the building — anything distributed to the whole staff cannot be Confidential, because Confidential means access is controlled and this has none. It is Internal, and if that sits badly, the right response is not to reclassify it upward but to notice that a shared standing password is a weak control, which is a different lesson. The vulnerability report with a working exploit pulls the same way and belongs in Confidential rather than Restricted: it is genuinely dangerous, but the damage is to this company's systems, not a legal or regulatory breach, and that boundary is what separates the top two tiers. Going the other way, the org chart shown at an all-hands feels published because hundreds of people saw it, but everyone in that room was an employee — broad internal circulation is still internal. Compare it to the job posting, which is on the public website and is Public precisely because the company chose to put it there. The two PII cards are meant to be sorted against each other rather than in isolation. A customer name and email list is personal data and belongs in Confidential; Social Security and government ID numbers are personal data too, and they go to Restricted. Both are PII, so "is it PII?" cannot be the deciding question. What separates them is what an attacker can do with it and what the law says about losing it: an email address enables spam and targeted phishing, while an SSN enables identity theft and drags statutory breach-notification duties along with it. Patient records land in Restricted for the same reason — PHI under HIPAA carries a specific legal regime, not just an expectation of discretion. Encryption private keys and root CA certificates are the one Restricted item that is not about a person at all; they are Restricted because compromising them silently invalidates every other control that depends on them. Misclassification costs in both directions, which is why the third objective exists and why over-classifying is not the safe default it appears to be. Under-classify and you have quietly removed the controls the data needed. Over-classify and you impose approval workflows and encryption requirements on a marketing brochure, which teaches employees that the classification scheme is theater and trains them to route around it — and a scheme people work around protects nothing. "When unsure, mark it Restricted" is a real anti-pattern, not caution. One wrinkle to carry into the exam room: this four-tier ladder is a common corporate convention, not a universal standard, and CompTIA Security+ SY0-701 objective 3.3 lists data classifications as sensitive, confidential, public, restricted, private and critical — six labels rather than four, and not arranged as a strict ladder. The reasoning is identical, and the consequence test above still decides every one of them; what changes is the label set. Expect the tier names to differ between an employer's policy and an exam objective, and treat the question "what happens if this gets out?" as the portable part.