Data Classification Policy
Establishes the data classification scheme used at Your Organization — Public, Internal, Confidential, Restricted — and defines handling, storage, and transmission rules for each level.
Read it now — the PDF opens either way.
Purpose
Not all information at Your Organization carries the same sensitivity or protection obligations. This policy establishes a consistent classification scheme so that workforce members can recognize what data they are handling, apply proportionate protections, and comply with legal, regulatory, and contractual obligations governing that data.
Scope
This policy applies to all information created, received, stored, processed, or transmitted by Your Organization, in any form (electronic, paper, verbal), regardless of location (on-premises, cloud, endpoint, mobile, removable media, third-party service). It applies to all workforce members and any third party that handles Your Organization information.
8 more sections in the full template
Classification levels · Responsibilities · Labeling · Transmission · Retention and disposal · Third parties · Scope exceptions · Review cadence. Download the full document above, or open it in CMDash to fill in your organization name and effective date automatically.
Use this policy for real, not just on paper
“Open in CMDash” pre-selects the Data Classification Policy template the first time you create a policy — your organization name and today’s date fill in automatically, and it lands as a DRAFT you can edit before publishing.