# Document & Data Classification Guide Page (for Google Drive)

A framework for classifying documents by sensitivity, and applying it in Google Drive.

## The three tiers

| Tier | What | Examples | Sharing |
|---|---|---|---|
| **Low** | Public or public-ready | Blog posts, marketing, published reports | Anyone with the link is fine |
| **Medium** | Internal, not secret | Meeting notes, draft strategy, budgets pre-approval | Named people or internal group only; no link sharing |
| **High** | Confidential, regulated, or PII | SSNs, financial/payroll data, health info, donor/client records, credentials, HR files | Named individuals only, reviewed periodically; no link sharing |

**Quick test:** Would it place someone at risk if it leaked? If so, it should be at least **Medium**. Does it contain PII, financial, health, or credential data? It shoul be **High**. Is it meant to be public? Make it **Low**. 

## Applying Tiers to Google Drive

**Naming:** tag files/folders so sensitivity is visible at a glance, e.g. `[H] Donor Contact List`.

**Folders:** separate top-level folders per tier (`Public/`, `Internal/`, `Confidential/`) rather than mixing tiers in one folder. Restrict access at the folder level for `Confidential/`.

**Sharing settings:**

| Tier | Link sharing | Editors |
|---|---|---|
| Low | On | Few editors, open viewing |
| Medium | Off | Named editors/viewers |
| High | Off, access reviewed regularly | Minimal editors; disable download/print/copy for viewers where possible |

**Review:** quarterly, check who still has access to `Confidential/` files, flag any "anyone with the link" shares that should be tighter, and sort anything sitting untagged in a misc folder.

**If overshared:** fix the sharing setting immediately, move the file to the right folder, and flag it to whoever owns incident response if High-sensitivity data was exposed.