Data Classification

Data Classification

Classify data by sensitivity level for "$ARGUMENTS". Define classification levels, inventory data types, and establish handling requirements that protect data proportionate to its sensitivity.

Prerequisites

Read .metapowers/security/$ARGUMENTS/00-govern.md. If this file does not exist, tell the user:

Phase 0 (Govern) has not been completed for "$ARGUMENTS". Run a Govern skill first (e.g., /security:security-policy $ARGUMENTS), or use --skip-checks to bypass.

If --skip-checks is present in $ARGUMENTS, skip this check and log to .metapowers/security/$ARGUMENTS/skip-log.md.

Process

1. Define classification levels:

   • Public — information intended for public consumption; no impact if disclosed (marketing materials, public docs, open-source code)
   • Internal — general business information not intended for public release; minor impact if disclosed (internal memos, org charts, non-sensitive reports)
   • Confidential — sensitive business information; significant impact if disclosed (financial data, strategic plans, employee records, source code, customer lists)
   • Restricted — highest sensitivity; severe impact if disclosed (credentials, encryption keys, PII/PHI/PCI data, trade secrets, security configurations)

2. Create classification criteria per level:

   • For each level, define clear criteria to determine classification:
     • What types of data belong at this level?
     • What is the business impact of unauthorized disclosure?
     • What is the regulatory impact?
     • What is the reputational impact?
   • Provide examples for each level to aid consistent classification decisions
   • Define how to handle data that spans multiple levels (classify at the highest applicable level)

3. Inventory data types and classify each:

   • Enumerate all data types the organization creates, processes, or stores
   • For each data type, record: description, classification level, owner, storage locations, retention period
   • Common data types to evaluate: customer PII, employee records, financial transactions, health information, authentication credentials, logs, analytics data, intellectual property, communications

4. Define handling requirements per level:

   • For each classification level, specify requirements across:
     • Storage — encryption at rest, access controls, approved storage locations
     • Transmission — encryption in transit (TLS/mTLS), approved transfer methods, DLP controls
     • Access — who can access, authentication requirements, need-to-know basis
     • Retention — how long to keep, archival procedures, legal hold considerations
     • Disposal — secure deletion methods, certificate of destruction, media sanitization
   • Define escalating controls as sensitivity increases

5. Identify data with regulatory requirements:

   • PII (Personally Identifiable Information) — GDPR, CCPA, state privacy laws
   • PHI (Protected Health Information) — HIPAA, HITECH
   • PCI (Payment Card Industry data) — PCI DSS requirements
   • Financial data — SOX, GLBA requirements
   • Map each regulated data type to: applicable regulations, specific requirements, compliance deadlines, penalties for non-compliance

6. Write the artifact to .metapowers/security/$ARGUMENTS/01-identify.md with heading:

   Data Classification

   Include sections:

   • Classification Levels — definitions, criteria, and examples per level
   • Data Inventory — all data types with assigned classification and owner
   • Handling Requirements — storage, transmission, access, retention, and disposal per level
   • Regulatory Mapping — regulated data types with applicable frameworks and requirements
   • Implementation Guidance — how to label, handle, and monitor classified data

Output

The data classification written to .metapowers/security/$ARGUMENTS/01-identify.md. Present a summary to the user highlighting:

• Classification levels defined with key criteria
• Distribution of data types across classification levels
• Data types with regulatory requirements and applicable frameworks
• Critical handling requirements for Restricted and Confidential data