← CIS Controls v8 in plain English

3.7 IG2

Control 3 / Data Protection

Establish and Maintain a Data Classification Scheme

Think of it likeLabeling documents as 'Sensitive,' 'Confidential,' or 'Public' based on their importance.

In plain English

The family classifies their data according to its sensitivity, ensuring it’s handled appropriately based on its classification.

Related CSF subcategories (unofficial mapping)

ID.AM-05: Assets are prioritized based on classification, criticality, resources, and impact on the mission.ID.AM-07: Inventories of data and corresponding metadata for designated data types are maintained.