A data classification system is a method of organising and categorising information based on its sensitivity, value, and potential impact if disclosed or compromised. Here is a basic outline for a non-profit organisation’s data classification system:

Public Information: This category includes publicly available information such as the organisation’s mission statement, contact information, and annual reports. This information can be widely disseminated without restriction.

Internal Information: Information that is only intended for internal use, such as financial reports, employee information, and internal communications, falls under this category. This information should only be accessible to authorised personnel.

Confidential Information: Information that is highly sensitive and confidential, such as donor information, intellectual property, and confidential legal or financial documents, falls into this category. Access to this information should be strictly limited and only shared with those who have a need-to-know basis.

Restricted Information: Information that is restricted due to legal or regulatory requirements, such as personal data and confidential medical information, falls into this category. This information should be strictly controlled and used only for authorised purposes.

It is critical to note that data classification systems should be reviewed and updated on a regular basis to reflect changes in the organisation’s operations and risk profile. Furthermore, it is critical to provide employees with clear guidance and training on how to handle and protect various types of information, as well as to enforce security measures such as access controls, encryption, and backups to help prevent unauthorised access or data breaches.

Sources:

Data Breaches Crises and Opportunity by Sherri Davidoff

ACFE

ITIL 4