Classification schemes fail when they produce labels without consequences. This one attaches concrete handling rules to each tier (where it may be stored, who may access it, whether it can leave the country), so the label changes what happens.
Use four tiers, no more. Public, Internal, Confidential, Restricted covers almost every organisation. More tiers means people guess, and guessing defaults downward because the lower tier is less inconvenient.
Write handling rules that change behaviour. Each tier needs rules someone can follow: approved storage locations, whether it can go in email, whether it can be shared externally, retention, and disposal method. A tier with no distinct handling is not a tier.
Classify systems, not individual documents. Asking staff to label every file does not work at scale. Classify the repository instead (this SharePoint site holds Confidential data, this database is Restricted) and inherit from there.
Here's a preview. Unlock the free download to get all 4 sections (3 more below).
| Tier | Definition | Examples | Impact if disclosed |
|---|---|---|---|
| Public | Approved for release outside the organisation | Marketing pages, published pricing, job adverts | None |
| Internal | Routine business information, not for public release | Internal announcements, team documentation, org charts | Minor embarrassment |
More free templates IT teams use alongside this one.
Most organisations keep everything forever, which is expensive, increases breach impact, and conflicts with data protection obligations. A retention schedule only works if it names a legal basis per record type and records that deletion actually happened.
An acceptable use policy only does its job if you can prove someone agreed to it. This one pairs clear, enforceable clauses with the acknowledgment register that turns the policy into something you can actually rely on in a disciplinary or legal process.
Banning AI tools does not work. It moves usage onto personal accounts where you have no visibility at all. This policy assumes people will use AI and makes the boundary explicit: which tools, which data, and how to get something new approved.
Four is right for most organisations: Public, Internal, Confidential, Restricted. More levels create ambiguity, and when people are unsure they tend to classify downward because the lower tier imposes fewer constraints.
No, and asking them to does not work at scale. Classify repositories and systems instead and inherit the classification from location. Reserve explicit labelling for documents that leave their normal home.
Handling rules specific enough to follow without asking: approved storage, whether email is permitted, external sharing conditions, AI tool usage, retention, and disposal method. A tier with no distinct handling rules changes nobody's behaviour.
