# Data Classification Labels

| Level | Label | Examples | Controls |
|-------|-------|----------|----------|
| 4 | 🔴 RESTRICTED | PII bundles, credentials, private keys, cardholder data | Encryption, strict ACL, DLP, audit logging, MFA |
| 3 | 🟠 CONFIDENTIAL | HR records, financial reports, trade secrets, PHI | Encryption, need-to-know access, logging |
| 2 | 🟡 INTERNAL | Internal emails, architecture docs, policies | Access controls, no public sharing |
| 1 | 🟢 PUBLIC | Marketing materials, public docs, press releases | Integrity controls only |

## Handling Rules
- **RESTRICTED**: encrypt at rest (AES-256) and in transit (TLS 1.2+), no email, secure destruction
- **CONFIDENTIAL**: encrypt in transit, access logging, clean desk policy
- **INTERNAL**: basic access controls, do not post publicly
- **PUBLIC**: no restrictions beyond integrity
