Find Resources & Connect with members on topics that interest you.

Applications

Audit

Business Processes

Career Management

Cloud Computing/Virtualization

COBIT

Controls and Monitoring

Databases

Fraud and Computer Crime

Governance and Management

Industry

Information Security

IT Service Management

Mobile/Wireless

Operating Systems

Privacy/Data Protection

Regulations

Risk

Standards

AI - Acquire and Implement

PO - Plan and Organize

DS - Deliver and Support

ME - Monitor and Evaluate

Application Controls

Process Controls

Please sign in to see your topics.

You must be logged in to join this group.

PO2.3 - Data Classification Scheme

This topic is intended to enable collaboration and sharing of information to facilitate a better understanding and approach to implementing this COBIT control objective based on the risk, value and guidance provided by its corresponding control practices.

COBIT Control Objective PO2.3 - Data Classification Scheme is contained within Process Popup Define the Information Architecture

Click “Join This Community” to be able to actively participate in discussions and contribute content. You must be an ISACA member to join this topic. Join ISACA now.

 
This Topic Has:
2 Members
0 Online
879 Visits

 Recent Discussions

Community Leader

Knowledge Center Manager

Knowledge Center Manager

Title: Become a Topic Leader!

Points: 3

Data Classification Scheme

Establish a classification scheme that applies throughout the enterprise, based on the criticality and sensitivity (e.g., public, confidential, top secret) of enterprise data. This scheme should include details about data ownership; definition of appropriate security levels and protection controls; and a brief description of data retention and destruction requirements, criticality and sensitivity. It should be used as the basis for applying controls such as access controls, archiving or encryption.

View value and Risk Drivers  help

Hide value and Risk Drivers help


Value Drivers

  • Ensured availability of information that supports decision making
  • The focus of security investments based on criticality
  • Defined accountability for information integrity, availability and security
  • Data access consistently permitted based on defined security levels
   Risk Drivers
  • Inappropriate security requirements
  • Inadequate or excessive investments in security controls
  • Occurrence of privacy, data confidentiality, integrity and availability incidents
  • Non-compliance with regulatory or third-party requirements
  • Inefficient or inconsistent information for decision making

View Control Practices  help

Hide Control Practices  help

  1. Create a classification scheme that defines attributes for data classification, such as data ownership, definition of security levels (confidentiality, integrity and availability), a brief description of data retention and destruction requirements.
  2. Define data classification levels for each of the defined attributes (e.g., for confidentiality: public, internal, confidential).
  3. Identify business owners accountable for information (data owners).
  4. Ensure that the data owner classifies all information using the defined scheme and levels. Classification covers the whole life cycle of information from creation to disposal. Where an asset has been assessed as having a certain classification, any component inherits the same classification.
  5. Make owners understand the consequences of the classification, and balance security needs against cost considerations and other business requirements considering the value of the assets they own.
  6. Ensure that information and data are labelled, handled, protected and otherwise secured in a manner consistent with the data classification categories.

 

Discussions: 0 total

Must be a Topic member to contribute

No Results Found

Documents & Publications: 36 total

Must be a Topic member to contribute
View All »
Books
Cybersecurity: The Essential Body of Knowledge
Posted by ISACA 13 days ago
Books
Securing Clicks: Network Security in the Age of Social Media
Posted by ISACA 34 days ago
Books
Information Security Roles & Responsibilities Made Easy, Version 3.0
Posted by ISACA 34 days ago
Books
The Data Governance Imperative
Posted by ISACA 75 days ago
Books
The IBM Data Governance Unified Process
Posted by ISACA 83 days ago
Books
Data Protection: Governance, Risk Management, and Compliance
Posted by ISACA 110 days ago
View All »

Events & Online Learning: 8 total

View All »
7 May 2012
ISACA International Event
North America CACS 2012
Orlando, Florida, USA
Get the knowledge you need to stay one step ahead of the competition and keep up with changing professional trends at ISACA’s North America CACS Conference.
More »
Add to my Outlook
12 Jun 2012
ISACA International Event
Training Dallas Texas USA
Dallas, Texas, USA
ISACA Training is a unique educational event designed to provide the tools you need to maintain, update and upgrade your skills, and to continue your professional development.
More »
Add to my Outlook
Register Now
7 Aug 2012
ISACA International Event
Training Chicago Illinois USA 2012
Chicago, Illinois, USA
ISACA Training is a unique educational event designed to provide the tools you need to maintain, update and upgrade your skills, and to continue your professional development.
More »
Add to my Outlook
Register Now
10 Sep 2012
ISACA International Event
Information Security and Risk Management Conference: Europe
Munich, Germany
EuroCACS/ISRM is a multidimensional event featuring audit, security, governance and risk content, and the audit and security programs, tools and the resources you need to be responsive to industry changes.
More »
Add to my Outlook
Register Now
11 Sep 2012
ISACA International Event
Training San Francisco California USA
San Francisco, California, USA
ISACA Training is a unique educational event designed to provide the tools you need to maintain, update and upgrade your skills, and to continue your professional development.
More »
Add to my Outlook
Register Now
2 Oct 2012
ISACA International Event
Training Orlando Florida USA
Orlando, Florida, USA
ISACA Training is a unique educational event designed to provide the tools you need to maintain, update and upgrade your skills, and to continue your professional development.
More »
Add to my Outlook
Register Now
View All »

Journal Articles: 208 total

View All »
Volume 3, 2012
Cloud Computing as an Integral Part of a Modern IT Strategy
by Kai-Uwe Ruhse, CISA, PCI QSA, and Maria Baturova
This article describes real cloud computing project case studies, which show that moving to the cloud is an important strategic decision for IT managers.
Volume 3, 2012
A Primer on Nonrelational, Distributed Databases for IS Professionals
by Steve Markey
Once thought of as a technology solely for academia, non-RDBMS are now reaching critical mass in industry.
Volume 2, 2012
Strengthening Information Security Governance
by Ed Gelbstein, Ph.D.
In the last couple of years, it has become evident that no organization can avoid being influenced by the tsunami of innovative technology, with ever shorter life cycles.
Volume 2, 2012
A Case for a Partnership Between Information Security and Records Information Management
by Kerry A. Anderson, CISA, CISM, CRISC, CGEIT, CISSP, ISSMP, ISSAP, CSSLP, CFE
The closer alignment between RIM and information security may provide an approach to managing increasing data protection concerns and tough privacy regulations rather than maintaining the separation between these critical compliance functions.
Volume 2, 2012
Testing Controls Associated With Data Transfers
by Tommie W. Singleton, Ph.D., CISA, CGEIT, CITP, CPA
This article addresses some of the IT audit issues associated with data transfers.
Volume 2, 2012
JOnline: Customer Relationship Information Technology Internal Control and Security Framework
by Robbie Sauerberg, Weston Smith and Jonathan Tudor, CCNA
This article first describes the benefits of CRM systems and identifies risk areas inherent in CRM systems that threaten the benefits an organization can receive from a CRM system.
View All »

User Contributed External Links: 0 total

Wikis: 2 total

Blog Posts: 10 total

View All »
7 Mar 2012
Cloud Computing
To share various espects in cloud computing viz; history, availability, deployment, integrity, availability, confidentiality, security, cloud sharing etc.
Posted By : MoizB583519 | 2 comments
6 Mar 2012
SQL Injection story is 14 year old and still the monster is far from being tamed
On March 1st,  I was invited to speak at the CampIT conference on Enterprise Risk/Security Management at Rosemont Convention Center. Before me there were two speakers. The first presenter spent an hour presenting the story from the trenches of technolog...
Posted By : Umesh391 | 0 comments
22 Nov 2011
Establishment of IT Security Policies for an Organization Which is Immature in IT Governance
I am interested in system security & control and therefore have joined ISACA as a member for several years.  Besides, I am a CISA and CISM in titles. To take advantage of membership privilege, I can easily collect up-to-date information related to standar...
Posted By : Calvin Tsang | 2 comments
29 Oct 2011
The articulation of a trilogy in the security strategy (cyber-terrorism in Colombia)
(By: William Darío Ávila Díaz, PhD) During the National Forum on National Security and Defence held on August 30, 2011 in Barranquilla, Teatro José Consuegra Higgins, the head of the Joint Chiefs, General Luis Felipe Paredes, spoke about...
Posted By : William733 | 0 comments
17 Aug 2011
IT Security
Posted By : masarker | 0 comments
5 Jul 2011
APT Defense Strategy
APT Defense Strategy   By Kevin J. Murphy, CISSP, CISM, CGEIT September 30, 2010 WHAT IS APT? APT is an acronym for Advance Persistent Threat.  Isn’t that descriptive?  In reality there is a lot behind the APT which might not be that obvious from underst...
Posted By : Kevin J. Murphy | 1 comments
View All »
Report An Issue