Internal Use

Data Classification Policy

Document Control

1. PURPOSE AND SCOPE

1.1 Purpose

This policy assists employees and third parties in understanding Dispel’s information labeling and handling guidelines. It defines how data is classified based on sensitivity and impact so that appropriate controls can be applied to protect confidentiality, integrity, and availability.

1.2 Scope

This policy applies to all information that is received, stored, processed, or transmitted by Dispel through any medium, including but not limited to:

• Electronic data (e.g., databases, files, emails, SaaS platforms).
• Hardcopy documents and records.
• Verbal communications where organizational or customer information is discussed.

1.3 Regulatory and Framework Alignment

2. POLICY STATEMENTS

2.1 Management Commitment

Management Commitment Statement

Senior Management at Dispel is dedicated to the protection of our information assets, industrial control systems, and Protected Health Information (PHI). We assume full accountability for the effectiveness of our security program, ensuring it is integrated into all business processes and aligned with our strategic goals. To maintain compliance with ISO 27001, IEC 62443, HIPAA, and NIST 800-53, we formally commit to:

• Resource Provisioning: Providing the necessary financial, technical, and human resources to sustain a robust security posture.
• Risk-Based Governance: Approving security policies and overseeing a continuous risk management process that prioritizes both data privacy and operational safety.
• Operational Resilience: Supporting the security of industrial automation and control systems (IACS) to ensure safety and reliability.
• Continuous Oversight: Conducting regular management reviews to evaluate program performance, audit results, and opportunities for improvement.

2.2 Primary Policy Statement

Dispel SHALL classify information based on its sensitivity and potential impact if compromised, and SHALL apply controls commensurate with that classification to protect confidentiality, integrity, and availability.

2.3 Secondary Policy Statements

At a minimum, Dispel SHALL:

• Require that all data be assigned a classification level (Restricted/Confidential, Internal Use, or Public).
• Maintain labeling and handling requirements appropriate to each classification level.
• Ensure that classification is considered during system design, data onboarding, and vendor selection.
• Align classification and handling practices with related policies such as the Information Security Policy, Data Retention Policy, and Asset Management Policy.

3. REQUIREMENTS

3.1 Data Classification Scheme

Objective: Define a consistent scheme for classifying data and the corresponding controls.

Mandatory Activities:

1. All data SHALL be categorized into one of the following levels:
   • Restricted/Confidential
   • Internal Use
   • Public
2. Data owners (asset owners) SHALL assign classifications based on the potential impact of unauthorized disclosure, alteration, or destruction.
3. Data classification SHALL be reviewed periodically or when business, regulatory, or contractual conditions change.

Required Outputs:

• A current inventory of information assets with assigned classifications.

Security Controls: SOC 2 CC2.x, CC8.1; ISO 27001 A.5.12–A.5.14.

Approval Required: Policy Owner.

3.2 Handling Controls by Classification

Objective: Ensure that handling controls (access, labeling, transmission, storage, destruction) match classification.

Mandatory Activities:

1. Restricted/Confidential data SHALL be limited to individuals with a legitimate need-to-know and MUST be protected against loss, theft, unauthorized access, and disclosure.
2. Internal Use data SHALL be restricted to personnel with a business need and protected from unauthorized access, modification, and transmission.
3. Public data MAY be freely shared but MUST still be protected from unauthorized alteration or destruction.
4. Handling and labeling guidelines (e.g., encryption requirements, NDA usage, physical protections) SHALL be followed as defined in this policy and related procedures.

Required Outputs:

• Documented handling standards per classification level.

Security Controls: PL-2, MP-5, MP-6; IEC 62443-2-1.4.3.

Approval Required: Policy Owner, Security Officer.

4. ROLES AND RESPONSIBILITIES

4.1 Policy Owner (e.g., CEO or Delegate)

Responsibilities:

• Owns this Data Classification Policy.
• Reviews and, if necessary, updates the policy at least annually.
• Monitors the number of incidents related to unauthorized access and misclassification as key effectiveness indicators.

4.2 Asset Owners

Responsibilities:

• Classify information assets they own.
• Ensure appropriate labeling, handling, and retention are applied to their assets.

4.3 All Personnel

Responsibilities:

• Follow classification, labeling, and handling rules in everyday work.
• Seek guidance when classification is unclear.
• Report suspected misclassification or handling issues.

5. PROCEDURES

5.1 Classification and Labeling Procedure

Additional procedural details (e.g., specific marking formats, label placement, and system-level configuration) MAY be maintained in supporting standards or implementation guides.

6. MONITORING AND COMPLIANCE

6.1 Compliance Monitoring

Compliance with this policy SHALL be monitored through:

• Review of incidents related to unauthorized access or misclassification.
• Periodic audits of information assets and their documented classifications.
• Spot checks of labeling and handling practices.

6.2 Metrics and Reporting

6.3 Non-Compliance Consequences

Non-compliance with this policy may result in:

• Corrective and preventive actions.
• Disciplinary measures up to and including termination.
• Additional technical or procedural remediation.

7. EXCEPTIONS AND WAIVERS

7.1 Exception Process

Exceptions to this policy SHALL:

1. Be submitted in writing by the requesting party.
2. Include detailed justification and business impact.
3. Describe compensating controls or mitigation measures.
4. Define exception duration and remediation plan.

7.2 Exception Approval Authority

8. DEFINITIONS

Confidential/Restricted Data: Highly valuable, highly sensitive business data where unauthorized access, alteration, or destruction could cause significant damage to Dispel or its customers (e.g., PHI, PII, data protected by confidentiality agreements).

Internal Use Data: Information originating within or owned by Dispel (or entrusted to it by others) that is not intended for public release and where unauthorized access could cause moderate damage.

Public Data: Information approved for release to the general public with minimal risk if disclosed, though integrity protection is still required.

Instant Messenger: Personal communication channels such as SMS or Apple iMessage, distinct from company chat platforms like Slack or Microsoft Teams.

Remote Access: Access to SaaS provider environments (e.g., Box, Slack, Microsoft 365) rather than traditional on-premises data centers; still requires secure practices such as VPN use on untrusted networks.

9. REFERENCES

9.1 Internal References

• Information Security Policy
• Asset Management Policy
• Data Retention Policy
• Data Deletion Policy

9.2 External References

• SOC 2 Trust Services Criteria
• ISO/IEC 27001 Annex A.5.12–A.5.14
• NIST SP 800-53 (PL and MP families)
• IEC 62443-2-1
• HIPAA Security Rule (45 CFR §164.308)

10. DOCUMENT HISTORY

11. APPROVAL SIGNATURES

END OF POLICY

APPENDICES

Appendix A: Handling Controls per Data Classification (Summary)

The detailed handling table from the prior version (e.g., NDA usage, encryption, labeling, and transmission requirements per classification and medium) is maintained logically as part of this appendix and may be referenced directly from the Data Classification and Handling Standard.

Appendix B: Steps and Responsibilities for Information Management

Explanation of changes

Reviewed for new year. Policy is unchanged.

Creation date Approval date Published date Owner Approver Publisher

January 12, 2025 January 14, 2025 January 14, 2025 Ethan Schmertzler Ethan Schmertzler Ethan Schmertzler