Organizations could implement standardized data labelling to identify and track all pieces of company data throughout its lifecycle.

Control Type: Technical

Control Function: Preventive

A crucial part of data governance is implementing a standardized method of labelling each piece of data within an organization. At the start of Stage 1 in this framework, you may have had a messy collection of data that lacked any oversight or visibility. By implementing data discovery, categorization, and classification, you were able to get a centralized view of all data proliferating throughout your environment. However, you still need to implement means by which data can be tracked and understood throughout its lifecycle. To do this, there should be a standardized data labelling process implemented.

 Data labels help identify attributes of pieces of data throughout their lifecycle. This ensures that an organization can understand what the data is, why it is there, and how it needs to be treated. Some general types of information that may be included on labels include:

  • Date of creation
  • Date of scheduled destruction/disposal
  • Confidentiality level
  • Handling directions
  • Dissemation/distribution instructions
  • Access limitations
  • Source
  • Jurisdiction
  • Applicable regulation

There are two main forms of data labelling:

  1. Hardcopy labels
  2. Digital labels

Hardcopy labels are applied to printed/physically stored data. Organizations of all sizes have thousands of pieces of paper proliferating throughout their facilities daily.  Each document has a different story, purpose, and level of sensitivity, and data labelling makes it easier to identify these attributes. Standard forms of hardcopy data labelling include embedding identifying attributes on title pages and in headers and footers. The US government is a great example of a standardized data labelling process. Cover sheets for documents indicate the sensitivity level of the data in big bold letters, such as Top Secret, Secret, and Confidential. These labels may also be stamped on other pages within the document.  In addition, cover pages are given a designated color indicating its sensitivity level:

  • Blue = Confidential
  • Red = Secret
  • Orange = Top Secret
  • Purple = Controlled Unclassified Information (CUI)

Private organizations could implement a similar system. This would make it extremely easy to visually distinguish the sensitivity and purpose of documents throughout the facilities. It would also help quickly identify security violations, such as a Top-Secret document laying out on a meeting table.

For digital data labelling, things can get a little more complex. The simplest way to label data is to enforce a standardized naming convention whenever files are created. This way files aren’t assigned random or default names that give little indication as to the data’s purpose. File names can also be nested into folders that denote subcategories of the same data. Organizations can choose file prefixes/naming schemes at their discretion, but at minimum they should indicate the sensitivity label, originating department, version (if applicable), and unique purpose of the file.

Example conventions could include:

               PUB – EventFlyer-v2.docx

               INT – NewHRPolicy.pdf

               CONF – NewContracts.xlsx

               RESTR – CustomerCCNumbers.csv

Or:

               [PUBLIC] – FinancialAidSupportSheet.pdf

               [INTERNAL] – InteriorOfficeDesignPlans.pptx

               [CONFIDENTIAL] – CollegePartyIncident.docx

               [RESTRICTED] – StudentFAFSAInfoSheet.csv

The issue with this approach is that organizations need to rely on their users to input the proper naming syntax on every piece of data, which likely will be forgotten pretty quick.

A more advanced digital labelling approach involves using metadata as the basis. Rather than including the labels in the filename structure, data identifiers are attached to the metadata of each file. Metadata already includes some useful information by default, such as creation date, last modification timestamp, and originating application. However, data governance tools such as Microsoft Purview and Adobe Experience Manager can take this further by including additional metadata fields like classification, data owner, retention period, and sensitivity level.

The modern enterprise standard for mature data governance programs is to directly embed labels within the documents themselves, such as in the header or footer. These labels are persistent and can track data throughout the lifecycle, and even dynamically restrict how it can be used. Microsoft Purview provides such features, allowing administrators to:

  • Tag files
  • Watermark files
  • Encrypt files
  • Restrict printing and forwarding
  • Audit access history

The data processor will see a label on the file denoting the sensitivity level and the originating/assigned department, while the metadata tracks the file’s usage.

Regardless of which data labelling process an organization chooses, it must ensure that it is standardized and enforced across all departments and users. Naming conventions must be documented and taught to new employees, and the IT/security team must keep record of which fields are included/tracked in metadata.