Data Classification: Why Most Organizations Have a Scheme Nobody Uses

DATA GOVERNANCE

Written by: Devensa Advisory

A classification scheme with clean tiers on paper often fails to reach the data that actually needs to be labeled.Source: Normalyze and Enterprise Strategy Group research, via BetaNews

Data classification is the practice of labeling data by sensitivity, such as public, internal, confidential, and restricted, so the right controls get applied to the right information automatically. Most organizations have a classification policy that defines these tiers cleanly. Far fewer can say where their sensitive data actually sits against them. Research from Normalyze and the Enterprise Strategy Group found that around a quarter of businesses do not know where their sensitive data is located¹, and another 26 percent suspect they have already lost sensitive data without being certain.

A Scheme That Describes Data It Cannot Find

A classification policy is easy to write and hard to operate. The tiers themselves, public, internal, confidential, restricted, are close to industry standard and rarely the point of failure. What fails is application: new data gets created faster than anyone tags it, cloud storage and SaaS tools multiply the places sensitive information can end up, and the classification scheme quietly becomes a document describing an ideal state rather than a system tracking the actual one.

Data governance is often reduced to this single artifact, the classification policy, as if labeling data were the whole of the discipline. It is one piece of a broader function that also has to cover data quality, ownership, lineage, and retention. But classification is usually where the gap between policy and practice shows up first and most visibly, because it is the layer everything else, access controls, retention rules, breach response, depends on being accurate.

Why the Gap Is So Expensive When It Surfaces

IBM’s Cost of a Data Breach research has consistently found that unclassified or unmanaged data, sometimes called shadow data, drives up breach costs substantially. In IBM’s most recent findings, breaches involving shadow data cost roughly 16 percent more than the average breach and took meaningfully longer to identify and contain², because responders cannot scope what they cannot first locate and classify.

The same Normalyze and ESG research found that more than 60 percent of sensitive data now resides in public cloud services, a figure expected to keep climbing³, which means the classification problem is not static. It is growing faster than most manual tagging processes can keep pace with, and a scheme built for an on-premises data environment a few years ago is often already out of date with where the organization’s actual sensitive data lives today.

Roughly one in four organizations do not know where their sensitive data is located, and another 26% suspect they have already lost data without being certain.Source: Normalyze and Enterprise Strategy Group research, via BetaNews

The Breach Response Problem This Creates

When a breach happens, the first question is always scope: what data was affected, and how sensitive was it. An organization that cannot answer that question quickly, because its classification scheme does not reflect where data actually lives, ends up in a longer, more expensive investigation, and in some cases a delayed or incomplete regulatory disclosure, because it genuinely does not know what needs to be disclosed until the forensic work catches up to the mislabeled data. That delay itself carries additional regulatory exposure in jurisdictions with strict breach notification timelines.

A vCDO owns the discipline that keeps classification current. As a fractional executive delivered on an hours-pooled retainer, the vCDO builds the ongoing discovery and tagging process that a static policy document cannot provide on its own, sets ownership for data across business units, and can speak with authority to a board or a regulator about where sensitive data actually lives, not just what the classification policy says it should look like.

Grounding Classification in a Recognized Framework

DAMA-DMBOK

The DAMA Data Management Body of Knowledge treats data classification as one function within a larger data governance discipline that also includes data quality, metadata management, and data lineage. Applied properly, DAMA-DMBOK positions classification not as a one-time labeling exercise but as an ongoing function tied to data ownership: every data asset has a named steward accountable for keeping its classification current as the data or its use changes.

The Data Governance Institute Framework

The Data Governance Institute’s framework adds a decision-rights structure on top of classification: who decides how a piece of data should be classified, who can reclassify it, and who is accountable when classification lags behind reality. Without this decision-rights layer, a classification scheme has labels but no enforcement mechanism, which is exactly the gap that lets a scheme drift out of sync with actual data.

The TruMaturity™ Assessment scores Data Governance as one of six governance domains against the CMMI maturity scale, from Initial through Optimized. A classification policy that exists on paper with no ongoing discovery process or named data stewardship typically scores toward the lower end of that scale, because the assessment is built to test whether classification reflects the organization’s actual data footprint, not whether the policy document is well written.

What Keeps a Classification Scheme Current

• An ongoing, automated discovery process for new and moved data, not a one-time inventory.
• Named data stewards accountable for specific data domains, not a policy owned by a department in the abstract.
• Classification tied directly to access controls, so a mislabeled asset is also a misconfigured one.
• A defined process for reclassifying data when its use or sensitivity changes.
• Regular reconciliation between the classification scheme and the organization’s actual cloud and SaaS footprint.

Bringing the Scheme Back in Line with Reality

1. Run a current-state discovery pass across cloud and SaaS environments before revising the classification policy itself. Fixing the document first, without knowing where the data is, repeats the original mistake.
2. Assign named stewards to specific data domains, with classification accuracy as an explicit part of their accountability.
3. Connect classification to access control enforcement directly, so an unclassified asset defaults to the most restrictive access, not the most permissive.
4. Build reclassification into the process for any new system, integration, or AI tool that touches existing data.
5. Test the scheme against a real question: if you had to scope a breach today, could you tell a regulator what was affected and how sensitive it was, within hours rather than weeks.

Frequently Asked Questions

What are the standard tiers in a data classification scheme?

Most schemes use some version of public, internal, confidential, and restricted, sometimes with additional regulatory-specific tiers layered on for data like health or payment information. The tier structure itself is rarely the point of failure; consistent application to actual data is where most organizations fall short.

Why does data classification matter more once an organization moves to the cloud?

Cloud and SaaS adoption multiply the number of places sensitive data can end up, often faster than manual classification processes can track. Research from Normalyze and ESG found more than 60 percent of sensitive data now sits in public cloud services, a share expected to keep rising, which makes automated discovery increasingly necessary rather than optional.

How does poor data classification make a data breach more expensive?

Unclassified or unmanaged data, sometimes called shadow data, slows down breach scoping because responders cannot assess what was affected until they first locate and classify it. IBM’s breach cost research has consistently found breaches involving this kind of data cost more and take longer to contain than the average.

Who should own data classification inside an organization?

Ownership works best distributed to named stewards for specific data domains, coordinated by a central data governance function, often led by a vCDO in organizations without an internal Chief Data Officer. A classification policy owned only by IT in the abstract, with no named accountability per data domain, tends to drift out of date quickly.

How often should a data classification scheme be reconciled against actual data?

Continuously, through automated discovery tools, rather than through periodic manual audits alone, given how fast new data and new storage locations accumulate. If a breach happened at your organization tomorrow, how confident are you that your classification scheme reflects where the affected data actually lives?

Sources

1. Normalyze and Enterprise Strategy Group, cloud data visibility research, coverage via BetaNews — https://betanews.com/2024/10/02/do-you-know-where-your-sensitive-data-is/

2. IBM, Cost of a Data Breach Report, shadow data cost findings, coverage via Comforte Insights — https://insights.comforte.com/as-breach-costs-surge-companies-need-a-better-way-to-find-shadow-data

3. Normalyze and Enterprise Strategy Group, public cloud sensitive data share, coverage via BetaNews — https://betanews.com/2024/10/02/do-you-know-where-your-sensitive-data-is/

This article is provided for informational purposes only and does not constitute legal or compliance advice. Consult qualified counsel before making governance decisions.