Confidentiality / Privacy
Data classification and handling rules define Confidential, Restricted, Customer Confidential, Internal, and Public information treatment and support identification of confidential information.
Use this guide to put the control into operation, decide what records to retain, and check that an auditor can trace the evidence back to the work your team performed.
Maintained by GreenHat Security · Reviewed August 21, 2026
Personnel can consistently identify confidential information and apply handling rules appropriate to categories such as Restricted, Customer Confidential, Confidential, Internal, and Public data.
First SOC 2 program
Define a small, understandable classification scheme using categories that fit the company, with examples drawn from customer content, credentials, product designs, contracts, personnel records, support material, and public information. Pair each category with concrete handling behavior.
As the company scales
Manage classifications in the data and asset inventories, apply labels in collaboration and data platforms, and connect them to access, encryption, sharing, monitoring, retention, and disposal. Use discovery and data-loss controls to find material that is unclassified or handled inconsistently.
Describe each classification with decision rules, business examples, owner, and how to resolve information that could fit more than one category.
You should end up with: An approved classification standard with examples and decision path.
For every category, state approved storage, access, sharing, transfer, encryption, logging, retention, disposal, and non-production use.
You should end up with: A concise handling matrix that personnel and system owners can apply.
Have owners classify customer data stores, credentials, contracts, design records, personnel information, support exports, and other important repositories.
You should end up with: Inventory entries or repository labels with owner and review date.
Configure available labels and prompts in document, email, storage, ticketing, and data platforms without relying on labels alone for protection.
You should end up with: Label configuration and sampled labeled records across key systems.
Give personnel short examples of how to store, share, export, print, discuss, and dispose of each category and where to ask about ambiguity.
You should end up with: Role-relevant communication or training record with the current standard version.
Periodically sample repositories and sharing activity, investigate unclassified or misclassified information, and track exceptions to resolution.
You should end up with: A review report with findings, owners, and corrective actions.
Build the evidence set in three layers: what defines the control, who approved or reviewed it, and what proves it operated. Collect operating records when the work happens so they remain dated, attributable, correctly scoped, and traceable to the underlying activity.
Before sharing, remove unrelated personal or customer data, never expose passwords, tokens, or secret values, preserve enough source context to authenticate the record, and use the secure exchange approved for the engagement.
Documents that define the control, its scope, ownership, and expected way of working.
Confirm what the record proves
Shows the approved definitions, decision rules, examples, ownership, and handling expectations for Restricted, Customer Confidential, Confidential, Internal, Public, or other adopted categories.
Include this context
classification levels
Include this context
decision criteria and examples
Include this context
required handling by level
Include this context
exception or escalation path
Include this context
owner and approver
Include this context
effective and review dates
Weak evidence to avoid
A glossary of labels with no decision rule, company examples, required handling, owner, or effective date.
Confirm what the record proves
Shows which repositories and data sets contain confidential information, their assigned category, owner, location, purpose, and lifecycle context.
Include this context
data set and repository identifier
Include this context
data categories
Include this context
classification
Include this context
system location
Include this context
owner and purpose
Include this context
review date
Weak evidence to avoid
A systems list that does not identify confidential data sets, classification, owner, location, or operational copies.
Confirm what the record proves
Shows where customer-confidential information enters, is stored, copied, processed, shared, backed up, and leaves, so its classification follows the full path.
Include this context
customer-data category
Include this context
collection source
Include this context
repositories and copies
Include this context
processors and recipients
Include this context
flow direction
Include this context
owner and review date
Weak evidence to avoid
A map ending at the production database that omits logs, backups, analytics, support attachments, exports, and vendors.
Confirm what the record proves
Shows personnel the concrete storage, sharing, transfer, access, retention, and disposal behavior expected for each classification in an usable form.
Include this context
classification level
Include this context
approved storage and access
Include this context
sharing and transfer rules
Include this context
retention and disposal action
Include this context
help or exception contact
Include this context
version date
Weak evidence to avoid
A poster saying protect confidential data without explaining approved storage, sharing, transfer, retention, or escalation behavior.
Type 1
The classification standard, current confidential-data inventory and customer-data map, live handling reference, and all unclassified, disputed, or exception items on the examination date.
Type 2
Every new or materially changed information repository, customer-data path, support or collaboration location, export process, or third-party transfer during the review period that required classification, plus every scheduled owner review, reclassification, and handling exception decided during the period.
Reconcile current cloud, SaaS, collaboration, support, data-store, and discovery inventories to classified data records and customer flows; compare period repository and transfer changes with owner decisions and investigate every unclassified location, lost label, or handling exception.
Use this checklist to prepare for procedures an auditor may perform. The exact steps and sample selection depend on your engagement scope and the service auditor's professional judgment.
Determine whether the control is designed to achieve this result: Personnel can consistently identify confidential information and apply handling rules appropriate to categories such as Restricted, Customer Confidential, Confidential, Internal, and Public data.
Compare the documented owner with the intended role (Privacy Owner / CISO / Data Owners), then compare dated records with the stated cadence: Ongoing; periodic review by privacy/data owner.
Reconcile current cloud, SaaS, collaboration, support, data-store, and discovery inventories to classified data records and customer flows; compare period repository and transfer changes with owner decisions and investigate every unclassified location, lost label, or handling exception.
The classification standard, current confidential-data inventory and customer-data map, live handling reference, and all unclassified, disputed, or exception items on the examination date.
Every new or materially changed information repository, customer-data path, support or collaboration location, export process, or third-party transfer during the review period that required classification, plus every scheduled owner review, reclassification, and handling exception decided during the period.
Documents that define the control, its scope, ownership, and expected way of working.
For each selected record, confirm it demonstrates Shows the approved definitions, decision rules, examples, ownership, and handling expectations for Restricted, Customer Confidential, Confidential, Internal, Public, or other adopted categories.
For each selected record, confirm it demonstrates Shows which repositories and data sets contain confidential information, their assigned category, owner, location, purpose, and lifecycle context.
For each selected record, confirm it demonstrates Shows where customer-confidential information enters, is stored, copied, processed, shared, backed up, and leaves, so its classification follows the full path.
For each selected record, confirm it demonstrates Shows personnel the concrete storage, sharing, transfer, access, retention, and disposal behavior expected for each classification in an usable form.
Use the categories that apply to this control: connect any policy or design artifact to its approval or review record, then trace a selected operating record through execution, result, and any exception or remediation.
These identifiers help you navigate related Trust Services Criteria. They do not reproduce the criteria or prove that this control fully addresses them in your environment.
Confirm final scope, mappings, and testing expectations with your service auditor. SOC 2® is an AICPA trademark; GreenHat Security is not affiliated with or endorsed by AICPA.