9-2 Information Technology Use and Security Policy Manual - Chapter V: Data Classification Policy

Return to IT Use and Security Policy Manual Table of Contents

Approved by: Board of Supervisors of the County of Sonoma (“County”), and the Boards of Directors of the Northern Sonoma County Air Pollution Control District, the Russian River County Sanitation District, Sonoma Valley County Sanitation District, Occidental County Sanitation District, South Park County Sanitation District, and the Board of Directors of the Sonoma County Agricultural Preservation and Open Space District (collectively referred to hereinafter as “Special Districts”), and the Sonoma County Water Agency (“Agency”), and the Board of Commissioners of the Sonoma County Community Development Commission (“Commission”). The County, Special Districts, Agency and Commission are collectively referred to herein as “Local Agencies” or singularly as “Local Agency.”

Read next: VI. Information Security Incident Management Policy

What's on this Page

This Policy directs Local Agencies to classify their data to ensure the required security measures are applied. 

Local Agencies may not rely on this Policy to make determinations or implement the requirements of the California Public Records Act (Government Code Sections 6250-6265).

1. Data Categories
2. Data Classification Assignment
3. Security Requirements

Data Owners must classify Local Agency data into one of the following categories:

1. Confidential – Information protected from use and/or disclosure by law, regulation or standard, and for which the highest level of security measures are required.
2. Restricted – Information that requires special precautions to protect from unauthorized use, access, or disclosure.
3. Public - Information that is available for general access without review by the Data Owner and/or County Counsel.

Back to top

1. Default classification assignment for data is Restricted.
2. Any collection of data containing different classification assignments must be classified as a whole at the level applicable to the data with the highest assignment.
3. Classifications assigned to Local Agency data must be reviewed upon changing usage or law, and reclassified if necessary.
4. The classification level of replicated data must remain consistent with the original data.

Back to top

1. Each data category has security requirements based on law, regulation, common business practice, liability or reputational factors.
2. Security controls must be applied to each data category based upon the identified security requirements, and commensurate with the value of the information and risk of loss.

Back to top