Data Governance

Welcome to Data Governance

As LC State continues to enhance our data security and compliance practices, proper data labeling is an essential part of protecting sensitive information. This guide will help you understand how to classify and label data correctly, why it matters, and what to do if you're unsure.

What are the data classification levels?

LC State uses four classification levels to categorize data based on its sensitivity and the potential impact of unauthorized disclosure. Understanding these levels is the foundation of proper data labeling.

alt

Information that may be freely disclosed to anyone without causing harm to Lewis-Clark State College, its students, or employees.

Examples:

  • Course catalog, academic calendar, campus map
  • Public press releases, marketing materials, social media posts
  • Published research articles and abstracts
  • Directory information (when a student has not requested suppression)

Institutional information not intended for general public release. Unauthorized disclosure would cause minimal risk but could hamper operations or create confusion.

Examples:

  • Draft policies and meeting minutes
  • Departmental budgets, purchase requisitions, and vendor quotes (pre-award)
  • Building floor plans, internal phone lists
  • Non-public statistical reports, device inventory exports
  • Organizational charts containing degree levels, years of service

Data protected by law, contract, or College policy where unauthorized disclosure could harm individuals or the institution, lead to regulatory penalties, or damage reputation.

Examples:

  • Student birthdates
  • Student directory information for those who have opted for privacy
  • Donor profiles, gift agreements, alumni records containing contact details
  • Research data covered by non-disclosure agreements or involving human subjects
  • Student demographic information

Information subject to strict federal or state regulation (FERPA, GLBA, PCI-DSS, etc.). Loss or exposure could cause severe harm, identity theft, or significant fines.

Examples:

  • Social Security numbers, driver's license / passport numbers, full tax IDs
  • Credit card data, bank account or routing numbers, payroll direct deposit files
  • Financial aid records (student IRS data, FAFSA details)
  • FERPA-protected records: grades, transcripts, class rosters
  • Employee personnel files, performance evaluations, background checks

Which files do I need to label?

The goal will be to label all files but we will start with labeling Microsoft Office files (Word, Excel, PowerPoint, etc). 

How do I label files?

Labeling your data is straightforward, but it requires thoughtful consideration of the content. Here's how to approach it:

  1. Review the content: Look at what information your document, email, or file actually contains, not just what it's primarily about.
  2. Identify the highest sensitivity level: If your document contains a mix of data types, always label it at the highest (most sensitive) level present. For example, if a document is mostly Level 2 data but includes one student birthdate, it should be labeled as Level
  3. Apply or adjust the label: Use the sensitivity label feature in Microsoft Office applications (Word, Excel, PowerPoint, Outlook) to apply the appropriate classification. Remember to change the auto-applied Level 2 label if your content is public (Level 1) or contains confidential or restricted data (Level 3 or 4).
  4. Be consistent: Label documents as you create them, not just before sharing.

Click the links for the actual steps to label Office files and emails.

Pro Tip: When in doubt between two levels, choose the higher classification. It's better to be cautious with sensitive data than to under-protect it.

Why is data labeling important?

Proper data labeling is critical to LC State's data security strategy and has direct, practical implications for how your data is protected and used:

LC State will be implementing automatic encryption for all data labeled as Level 3 (Confidential) and Level 4 (Restricted). This means:

  • Documents labeled as Level 3 or 4 will be automatically encrypted to protect them from unauthorized access
  • If a document containing Level 3 or 4 data is mislabeled as Level 2, it will not receive this critical encryption protection
  •  Proper labeling ensures that sensitive information receives the security controls it requires

As we roll out Microsoft Copilot and other AI-powered productivity tools, data classification will determine what information these tools can access:

  • Copilot will be restricted from accessing Level 3 and Level 4 data to protect sensitive information
  • If sensitive data is incorrectly labeled as Level 1 or 2, it could inadvertently become accessible to AI tools
  • Correct labeling ensures we can use AI tools safely while protecting confidential information

  • Many data types (FERPA records, financial information, personal identifiers) are protected by federal and state laws
  • Proper classification helps ensure we're meeting our legal obligations
  • Accurate labeling reduces the risk of data breaches and the associated financial and reputational costs

What if I'm not sure how to label something?

It's completely normal to be unsure about how to classify certain data, especially when dealing with complex documents or unfamiliar data types. When you're uncertain, follow this escalation process:

A list of examples can be found here.

Start with the people who know your work best:

  • Co-workers: Colleagues working with similar data may have already encountered and resolved the same question
  • Your supervisor: Your immediate supervisor often has broader context about data handling requirements
  • Department director: Directors can provide guidance on departmental data practices and policies

If your department team is unsure or if the situation is complex, reach out to the Data Working Group. They're here to help with challenging classification decisions and can provide authoritative guidance.

Contact the Data Working Group: Contact information will be available soon.

  • When uncertain between two levels, temporarily use the higher classification until you get clarification
  • Don't delay labeling—apply your best judgment and seek guidance promptly
  • Keep a record of classification questions that come up repeatedly so they can be addressed in training or policy updates

What are the consequences of mislabeling data?

Mislabeling data—whether labeling it at too high or too low a level—can have real consequences for data security and usability. Understanding these risks helps emphasize why accuracy matters:

This is the more serious risk. When you label sensitive data at a lower level than it should be:

  • Lack of encryption: Documents containing Level 3 or Level 4 data that are mislabeled as Level 2 or 1 will not be encrypted, leaving sensitive information vulnerable to unauthorized access
  • Inappropriate AI access: Confidential or restricted data mislabeled as Level 1 or 2 could become accessible to Microsoft Copilot, potentially exposing sensitive information
  • Compliance violations: Failing to properly protect regulated data (FERPA, GLBA, etc.) could result in regulatory penalties, legal liability, and damage to LC State's reputation
  • Data breaches: Inadequately protected sensitive data is at higher risk of being compromised in a security incident

While less risky from a security standpoint, over-classification can create operational challenges:

  • Restricted collaboration: Over-classified data may be harder to share with appropriate colleagues, slowing down work (for example, when committee materials cannot be easily shared with all members)
  • Reduced efficiency: Public or internal documents labeled as confidential may be unnecessarily excluded from productivity tools that could help you work more effectively
  • Classification fatigue: If everything is labeled as highly sensitive, it becomes harder to identify what truly needs extra protection

Accurate data classification ensures that:

  • Sensitive information receives appropriate security controls
  • Less sensitive information remains accessible and useful
  • LC State meets its legal and ethical obligations to protect personal and institutional data
  • We can safely adopt new technologies and productivity tools