Which set of data security levels is commonly used to categorize data by sensitivity?

Which set of data security levels is commonly used to categorize data by sensitivity?

• A. Public, Internal, Confidential, Restricted
• B. Public, Internal, Secret, Restricted
• C. Public, Private, Confidential, Restricted
• D. Public, Confidential, Internal, Restricted

Answer: (A)

Data classification levels are used to categorize data by sensitivity to determine who can access it and how it should be protected. The commonly used set—Public, Internal, Confidential, Restricted—starts with data that can be shared openly (Public), then data meant for internal organizational use (Internal), followed by data that requires authorization and protection due to business impact (Confidential), and finally data with the highest sensitivity that needs the tightest controls (Restricted). This progression lines up with increasing risk and stricter access measures, which is why it’s widely adopted in governance practices. Other options mix terms that aren’t as standard in enterprise data protection (for example, using Secret, or Private, or placing categories in a different order), which can create ambiguity about required protections and access controls.

Data classification levels are used to categorize data by sensitivity to determine who can access it and how it should be protected. The commonly used set—Public, Internal, Confidential, Restricted—starts with data that can be shared openly (Public), then data meant for internal organizational use (Internal), followed by data that requires authorization and protection due to business impact (Confidential), and finally data with the highest sensitivity that needs the tightest controls (Restricted). This progression lines up with increasing risk and stricter access measures, which is why it’s widely adopted in governance practices.

Other options mix terms that aren’t as standard in enterprise data protection (for example, using Secret, or Private, or placing categories in a different order), which can create ambiguity about required protections and access controls.