Classification of Data

Why is there a need for data classification?

• To help us categorise our document so that we can search for it easily.

• To classify based on the importance and prioritise them for work purposes.

• To group them for easy data analysis in the future.

• To keep them secure so as to maintain stakeholders’ trust and confidence in our education.

Data can be classified based on security and sensitivity.

How many different levels of security classification are there?

• 6

• 5

• 8

• 7

Answer explanation

There are 6 levels:

Official (open)

Official (closed)

Restricted

Confidential

Confidential (cloud eligible)

Secret

How do we classify our document based on its sensitivity?

• based on the potential damage to personal interest

• based on the potential damage to national security

• based on the potential damage to an individual and/or business entity

• based on the potential damage to MOE security/interest

What is the security classification of the information that you can store or process on your personal devices?

• Up to CONFIDENTIAL (just like SSOE laptop)

• OFFICIAL (CLOSED) since it is not classified information

• Up to SECRET because you have the necessary security clearance

• None of the given options.

Answer explanation

You should not store or process ANY official government data (including unclassified government data) on your personal devices. They are exceptions for T&L content such as iCON and SLS, which can be processed and stored using personal devices. For non-SECRET users who need to store and process information up to CONFIDENTIAL, you should be using your SSOE laptop. You are reminded to use the appropriate devices for the processing and storage of classified information.

How would you classify a dataset which includes masked NRIC (eg: last 4 characters of NRIC/FIN) with stored name, contact, and addresses of individuals?

• NON-SENSITIVE

• SENSITIVE NORMAL

• SENSITIVE HIGH

Answer explanation

The Information Sensitivity Framework (ISF) classifies data based on the potential impact to an individual or entity in the event of an unauthorised disclosure. Hence with the names, contacts and addresses linked to the masked NRIC number, it is still considered as having some potential damage to the individual if the data is being disclosed.