<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-data-classification-framework
description: >-
  Implement data classification frameworks to categorize organizational data by sensitivity
  level, apply appropriate handling controls, and enforce classification through automated
  tagging, DLP policies, and access controls.
domain: cybersecurity
subdomain: security-architecture
tags:
  - data-classification
  - data-protection
  - dlp
  - sensitivity-labels
  - gdpr
  - pii
  - encryption
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1083"]
---

# Implementing Data Classification Framework

## Overview

Data classification is foundational to data protection — you cannot protect what you
cannot classify. This skill covers designing classification taxonomies, implementing
automated discovery and tagging, enforcing handling rules through DLP policies, and
mapping classifications to regulatory requirements.

Mode: `[MODE: ARCHITECT]` — Data protection architecture.

## Prerequisites

| Requirement | Details |
|---|---|
| Data inventory or data flow documentation | Required |
| DLP solution (Microsoft Purview, AWS Macie, or equivalent) | Required |
| Cloud KMS for encryption management | Required |
| Python 3.10+ | Required |

## Key Concepts

### Classification Taxonomy

```
┌────────────────────────────────────────────────────────┐
│              DATA CLASSIFICATION LEVELS                 │
├──────────┬──────────────┬──────────────────────────────┤
│  Level   │  Label       │  Examples                    │
├──────────┼──────────────┼──────────────────────────────┤
│  L4      │ RESTRICTED   │ Credentials, encryption keys │
│  L3      │ CONFIDENTIAL │ PII, financial, health data  │
│  L2      │ INTERNAL     │ Internal docs, org charts    │
│  L1      │ PUBLIC       │ Marketing, public docs       │
└──────────┴──────────────┴──────────────────────────────┘
```

### Handling Requirements Per Level

```yaml
restricted:
  encryption_at_rest: AES-256 with HSM-backed keys
  encryption_in_transit: TLS 1.3 with mutual authentication
  access_control: Named individuals only, MFA required
  logging: Full access audit logging, tamper-proof
  retention: Defined by legal/compliance, crypto-shred on deletion
  sharing: Prohibited without CISO approval
  storage: Dedicated encrypted storage, no shared infrastructure

confidential:
  encryption_at_rest: AES-256 with KMS-managed keys
  encryption_in_transit: TLS 1.2+
  access_control: Role-based, principle of least privilege
  logging: Access logging with 90-day retention
  retention: Per data retention policy
  sharing: Encrypted channels only, NDA required
  storage: Access-controlled storage, VPC endpoints

internal:
  encryption_at_rest: Default cloud encryption
  encryption_in_transit: TLS 1.2+
  access_control: Department-level access
  logging: Standard audit logging
  retention: Per retention policy
  sharing: Internal channels only
  storage: Standard cloud storage

public:
  encryption_at_rest: Optional
  encryption_in_transit: HTTPS
  access_control: None required
  logging: Optional
  retention: As needed
  sharing: Unrestricted
  storage: Any
```

### Automated Data Discovery

```bash
# AWS Macie — discover sensitive data in S3
aws macie2 create-classification-job --job-type ONE_TIME \
  --s3-job-definition '{
    "bucketDefinitions": [{
      "accountId": "123456789012",
      "buckets": ["company-data-bucket"]
    }]
  }' \
  --managed-data-identifier-ids '["PII", "FINANCIAL", "CREDENTIALS"]'

# Microsoft Purview — create sensitivity label
# Via PowerShell
# New-Label -DisplayName "Confidential" -Tooltip "Contains PII or financial data" \
#   -EncryptionEnabled $true -EncryptionProtectionType Template

# Check Macie findings
aws macie2 get-findings --finding-ids $(aws macie2 list-findings \
  --query 'findingIds[:5]' --output text)
```

### DLP Policy Configuration

```python
# DLP pattern matching for PII detection
PII_PATTERNS = {
    "ssn": r"\b\d{3}-\d{2}-\d{4}\b",
    "credit_card": r"\b(?:\d{4}[-\s]?){3}\d{4}\b",
    "email": r"\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b",
    "phone": r"\b(?:\+1[-.\s]?)?\(?\d{3}\)?[-.\s]?\d{3}[-.\s]?\d{4}\b",
    "passport": r"\b[A-Z]{1,2}\d{6,9}\b",
    "iban": r"\b[A-Z]{2}\d{2}[A-Z0-9]{4}\d{7}([A-Z0-9]?){0,16}\b",
}
```

## Workflow

### Step 1: Define Classification Taxonomy

```bash
node scripts/agent.js --action taxonomy --levels 4
```

### Step 2: Discover and Classify Data

```bash
node scripts/agent.js --action discover --source s3 --bucket company-data
```

### Step 3: Apply Labels and Controls

```bash
node scripts/agent.js --action classify --inventory data-inventory.json
```

### Step 4: Generate Compliance Report

```bash
node scripts/agent.js --action report --inventory data-inventory.json --output report.json
```

## Detection

```yaml
title: Data Classification Framework Detection
id: 9287966f-5b7b-45b5-83fc-3f1ca3fa66a2
status: experimental
description: Detects suspicious activity related to implementing data classification framework techniques in security architecture context
logsource:
  category: network_connection
  product: firewall
detection:
  selection:
    DestinationPort: 443
    Initiated: "true"
  condition: selection
level: medium
tags:
  - attack.t1083
  - attack.lateral_movement
falsepositives:
  - Network segmentation testing by authorized infrastructure teams
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Data Classification Framework Detection | firewall/network_connection | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1083 |

## Verification

- [ ] Classification taxonomy defined with clear level definitions
- [ ] Handling requirements documented per classification level
- [ ] Automated data discovery running on all data stores
- [ ] Sensitivity labels applied consistently across platforms
- [ ] DLP policies enforcing handling rules
- [ ] Encryption requirements met per classification level
- [ ] Access controls aligned with data classification
- [ ] Regular reclassification reviews scheduled

## References

- [NIST SP 800-60 — Guide for Mapping Information Types](https://csrc.nist.gov/publications/detail/sp/800-60/vol-1-rev-1/final)
- [ISO 27001:2022 Annex A.5.12 — Classification of Information](https://www.iso.org/standard/27001)
- [Microsoft Purview Data Classification](https://learn.microsoft.com/en-us/purview/data-classification-overview)
