Document & Data Classification Guide Page (for Google Drive)

A framework for classifying documents by sensitivity, and applying it in Google Drive. 
 The three tiers 
 
 
 
 Tier 
 What 
 Examples 
 Sharing 
 
 
 
 
 Low 
 Public or public-ready 
 Blog posts, marketing, published reports 
 Anyone with the link is fine 
 
 
 Medium 
 Internal, not secret 
 Meeting notes, draft strategy, budgets pre-approval 
 Named people or internal group only; no link sharing 
 
 
 High 
 Confidential, regulated, or PII 
 SSNs, financial/payroll data, health info, donor/client records, credentials, HR files 
 Named individuals only, reviewed periodically; no link sharing 
 
 
 
 Quick test: Would it place someone at risk if it leaked? If so, it should be at least Medium . Does it contain PII, financial, health, or credential data? It shoul be High . Is it meant to be public? Make it Low . 
 Applying Tiers to Google Drive 
 Naming: tag files/folders so sensitivity is visible at a glance, e.g. [H] Donor Contact List . 
 Folders: separate top-level folders per tier ( Public/ , Internal/ , Confidential/ ) rather than mixing tiers in one folder. Restrict access at the folder level for Confidential/ . 
 Sharing settings: 
 
 
 
 Tier 
 Link sharing 
 Editors 
 
 
 
 
 Low 
 On 
 Few editors, open viewing 
 
 
 Medium 
 Off 
 Named editors/viewers 
 
 
 High 
 Off, access reviewed regularly 
 Minimal editors; disable download/print/copy for viewers where possible 
 
 
 
 Review: quarterly, check who still has access to Confidential/ files, flag any "anyone with the link" shares that should be tighter, and sort anything sitting untagged in a misc folder. 
 If overshared: fix the sharing setting immediately, move the file to the right folder, and flag it to whoever owns incident response if High-sensitivity data was exposed.