Data-at-rest is protected

Data classification can be used to give data processors a quick view of how critical data is and how data should be processed and protected.

The data categories used and the corresponding security levels are defined. The category of information is defined by analyzing the confidentiality, integrity and availability of the information in question, as well as any other requirements. Each level is given a clear and descriptive name.

Data classifications can be, for example, the following:

• disclosure of information does not cause harm (PUBLIC)
• disclosure of information causes slight inconvenience or minor operational annoyance (CONFIDENTIAL)
• disclosure of information has significant short-term effects on operations or tactical objectives (LIMITED)
• disclosure of information has serious implications for long-term strategic objectives or jeopardizes the very existence of the organization (PROHIBITED)

CONFIDENTIAL paper information may require e.g. the following protections:

• Locked cabinet
• Trusted transfer partner
• Sealed envelopes
• Safe disposal process

CONFIDENTIAL electronic information may require e.g. the following protections:

• Use the selected encryption level
• Password protection
• Safe disposal process
• More limited access rights

Organization ensures confidentiality and integrity of all data at rest is protected across all storage systems:

• Cloud storages
• File hosting services
• Databases
• Data warehouses

The data can be protected by using physical and logical means.

Physical protection for data stored is ensured by using secure facilities, such as locked rooms or data centers, that prevent unauthorized physical access.

Logical protection is done by encrypting stored data using strong cryptographic algorithms and strict access control, ensuring only authorized users and systems can access the data.