Classification Framework Enforcement

Classification Framework Enforcement Skill

Purpose

This skill provides guidance for enforcing data classification across the Citizen Intelligence Agency platform. It defines classification levels, sensitivity labeling requirements, and mandatory handling controls for each level to ensure consistent data protection aligned with ISMS requirements.

When to Use This Skill

Apply this skill when:

• ✅ Designing new data models or database tables
• ✅ Implementing features that process or display data
• ✅ Reviewing code that handles user data or PII
• ✅ Configuring logging, caching, or data export
• ✅ Assessing data flows between system components
• ✅ Integrating with external data sources
• ✅ Conducting data protection impact assessments

Do NOT use for:

• ❌ Access control implementation (use access-control-policy)
• ❌ Encryption algorithm selection (use crypto-best-practices)
• ❌ Incident response procedures (use incident-response)

Classification Levels

CIA Platform Data Classification

Classification Decision Tree

New Data Element
    │
    ├─→ Is it publicly available from source?
    │   ├─→ YES → Is it aggregated/analyzed by CIA?
    │   │   ├─→ YES → 🟡 INTERNAL
    │   │   └─→ NO  → 🟢 PUBLIC
    │   └─→ NO
    │
    ├─→ Is it user-provided personal data?
    │   ├─→ YES → Is it authentication/credential data?
    │   │   ├─→ YES → 🔴 RESTRICTED
    │   │   └─→ NO  → 🟠 CONFIDENTIAL
    │   └─→ NO
    │
    ├─→ Is it a system secret (key, token, password)?
    │   ├─→ YES → 🔴 RESTRICTED
    │   └─→ NO
    │
    └─→ Is it internal analysis or derived data?
        ├─→ YES → 🟡 INTERNAL
        └─→ NO  → 🟢 PUBLIC (default to least restrictive only if certain)

Handling Controls by Classification Level

🟢 PUBLIC Data

🟡 INTERNAL Data

🟠 CONFIDENTIAL Data

🔴 RESTRICTED Data

Implementation Patterns

Database Column Classification

@Entity
@Table(name = "application_user")
public class ApplicationUser {

    @Column(name = "username")
    // Classification: CONFIDENTIAL — user-provided, non-public
    private String username;

    @Column(name = "email")
    // Classification: CONFIDENTIAL — PII under GDPR
    private String email;

    @Column(name = "password_hash")
    // Classification: RESTRICTED — credential data
    private String passwordHash;
}

Logging Guard

// DO: Log classification-safe data only
log.info("Processing politician data for id: {}", politicianId);  // PUBLIC id

// DON'T: Log CONFIDENTIAL or RESTRICTED data
// log.info("User login: email={}, password={}", email, password);

// DO: Use placeholder for CONFIDENTIAL data
log.info("User action completed for user id: {}", userId);

Caching Rules

// PUBLIC/INTERNAL: Standard caching allowed
@Cacheable(value = "politicians", key = "#id")
public Politician findPoliticianById(String id) { ... }

// CONFIDENTIAL: Short TTL, in-memory only
@Cacheable(value = "userProfiles", key = "#userId",
    cacheManager = "shortLivedCacheManager")
public UserProfile findUserProfile(String userId) { ... }

// RESTRICTED: Never cache
// No @Cacheable annotation — always fetch from secure storage
public String getApiKey(String serviceId) { ... }

Data Flow Classification

CIA Platform Data Flows

External APIs (Riksdag, World Bank) ──→ Service Layer ──→ Database
    🟢 PUBLIC data                      Classification    Labeled
                                        enforcement       storage
                                            │
                                            ▼
User Browser ◄──── Vaadin UI ◄──── Service Layer
    Display           Encoding        Access control
    controls          applied         enforced

Cross-Boundary Rules

Compliance Mapping

References

• ISO 27001:2022 Annex A — A.5.12-A.5.14 Information Classification
• NIST SP 800-60 Guide for Mapping Information Types
• GDPR Article 5 — Principles Relating to Processing
• Hack23 ISMS Data Classification Policy