Guidance for classifying information

1. Select the information or system to be classified

When do we need to conduct an information classification?

The classification of information should be the basis for the selection of appropriate safeguards in these situations:

• Prior to processing of personal data.
• Assessment of how research materials or data are be handled and thus protected.
• • Current situation assessment or risk analysis of an information system.
• Procurement, new development or changes to IT systems or infrastructure, such as data storage services.
• Establishing the security design of an information system.
• Changes in legal requirements.
• New information in the organisation.
• Approval of rules for processing information, such as requirements for encryption of emails and rules for communication by mobile phone

2. Classifying information based on confidentiality, accuracy and availability

Confidentiality

Base your actions on the consequences that may arise if protection is deficient:

Examples of consequences from deficient protection

Class 1: No consequences
Class 2: Moderate negative impact on one's own or another organisation and its assets or individuals. Limited dissatisfaction, expressed in national and local media. Significant loss of trust by collaborators or members of the public.
Class 3: Significant negative impact on one's own or another organisation and its assets or individuals. Limited dissatisfaction, expressed in national and local media. Significant loss of trust by collaborators or members of the public.
Class 4: Serious negative impact on one's own or another organisation and its assets or individuals. Many dissatisfied collaborators, heated discussions in national media and social media. Serious damage to trust.

Examples of information

Class 1: Publicly published text on Umeå University's website.
Class 2: Information contains personal data and caution applies when disseminating, sharing, publishing.
Class 3: Personal data meriting special protection. Other valuable information such as research materials, data, documentation and access logs.
Class 4: Classified information. Sensitive personal data, passwords, crypto keys, firewall rules or research materials especially worthy of protection, law violations, DUP (dual-use items).

Accuracy

Based on the consequences that may arise through inaccuracy

Possible consequences of inaccuracy

Class 1: No consequences
Class 2: Moderate inconvenience or limited financial loss for individuals, or limited damage to one's own or another organisation
Class 3: Significant inconvenience or financial loss for individuals, or extensive damage to one's own or another organisation.
Class 4: Severe adverse impact on one's own or another organisation and its assets or individuals, or the cause of widespread inconvenience or financial loss to a large number of individuals. May cause harm to the life or health of individuals.

Examples of information

Class 1:
Class 2: General information to external users, internal/external communication via email
Class 3: Research materials, undergraduate–doctoral education student assignments, personnel cases, logs
Class 4: Particularly sensitive research material, data, documentation, passwords, crypto keys, firewall rules

Availability

Based on the consequences that may arise if not available:

Possible consequences of lack of availability.

Class 1: No consequences
Class 2: Moderate negative impact on one's own or another organisation and its resources or individuals. A few disgruntled collaborators. Moderate declines in production.
Class 3: Significant negative impact on one's own or another organisation and its resources or individuals. Limited dissatisfaction. Large production declines.
Class 4: Serious negative impact on one's own or another organisation and its resources or individuals. Many dissatisfied collaborators. Very large production declines.

Exaples of information

Class 1:
Class 2: Personnel matters, financial data, payroll, logs
Class 3: The University's archive and registry
Class 4: National systems, such as Ladok