Carnegie Mellon University

Data Classification Workflow

Guidance to help you classify your data.

  1. Are you the data steward?
    Yes - move to question 3.
    No - consult the data steward for classification.
    Not sure - move to question 2.
  2. Did you create this data?
    Yes - move to question 3.
    No - consult with the Information Security Office to determine how to classify this data.
  3. Is this data governed by any law or regulation?
    Yes - move to question 7.
    No - move to question 4.
  4. Is this data governed by a Data Use Agreement or Confidentiality Agreement?
    Yes - the data is restricted.
    No - move to question 5.
  5. Are there significant consequences to the university if this data is exposed, altered, or destroyed?
    Yes - the data is restricted
    No - move to question 6.
    Not sure - refer to the Data Classification Guidelines to determine consequences.
  6. Are there moderate consequences to the university if this data is exposed, altered, or destroyed?
    Yes - the data is private.
    No - the data is public.
    Not sure - refer to the Data Classification Guidelines to determine consequences.
  7. Does the data have additional restrictions?
    Yes - the data is restricted specified.
    No - the data is restricted