What a finished information classification actually looks like
Most classification guidance stops at the form. You get the categories, you get the scale, and then you are on your own for the part that matters, which is deciding whether a system rates a 3 or a 4 and being able to defend it six months later.
A complete assessment of this quality normally takes days of internal debate and still produces numbers that are hard to defend. This worked example shows you the finished standard in one sitting, and the Excel workbook that produced it lets a competent team finish a single system in roughly 45 minutes and a full register of thirty systems in a fortnight.
This is the other thing. A complete Information and System Value Assessment, worked from start to finish for a (fictional) regional water utility with five systems supporting one business function. Not a sample. Not the first two rows filled in. All forty ratings, each with the written reasoning behind it.
The result that catches people out: the highest rated system in the register holds nothing confidential at all. It is a plant control system full of setpoints and tank levels. It rates Restricted because if somebody alters it, people can die. Most classification schemes rate that system below payroll, and that is the failure this instrument exists to prevent.
What is in the 14 pages
- The register of results. Five systems, four different sensitivity labels, and what drove each one
- Part 1. Scope, ownership, and the service elements that make up the business function
- Five complete assessments. Every consequence category rated, with the reasoning written into the record
- Part 3. The lifecycle and access record, which is the part an auditor actually asks for
- The commentary. Five judgment calls that shaped the register, and one edge case worth knowing about before you run an assessment of your own
Why the commentary is the useful part
Anyone can hand you a blank form. The judgment is in knowing why a zero rating is not the same answer as a one. Why a criterion written for a competitive market has to be overridden before a monopoly supplier can use it, and why that override has to be written down rather than quietly applied. Why a maintenance system rates lower than you would expect, and exactly what change to the architecture would push it higher.
And one honest edge case: a public website that comes out of the assessment rated Confidential. The document explains why that is not an error, why you should resist the temptation to quietly drop a rating until the answer looks tidy, and what to do instead.
Who it is for
Security and risk managers running an information asset classification program. Consultants who would rather adapt a working instrument than build one. Anyone facing an ISO 27001 asset inventory, a PSPF obligation, or an executive who wants to know what would actually hurt.
Riverina Water Corporation is fictional. Every name, figure, system and finding in the document was written for teaching. The method is not.
Free. No conditions attached.
Once you have read it
Everything in this document was produced in a single Excel workbook, and the same workbook is available if you want to run the assessment on your own systems. The downloadable zip file includes a blank template and a worked example, so you can keep a reference assessment open beside yours while you fill it in.
