Owner, Custodian, Controller, Processor: CISSP Data Classification, the Roles That Decide It, and the Handling Each Label Demands

A new head of data governance runs a discovery scan on the corporate file store and finds that 61% of documents are marked Confidential. The lunch menu is Confidential. The office move plan is Confidential. So are the pricing models a competitor would genuinely pay for, sitting in the same category with the same controls as the lunch menu. That is not a strict scheme; it is a scheme that has stopped conveying information. CISSP Domain 2 opens with classification because everything after it, handling, retention, destruction, depends on the label meaning something.

Two decisions, not one

The outline separates data classification from asset classification. Data classification grades information itself, in any form, by the impact of unauthorized disclosure, modification or loss. Asset classification grades the systems, devices, media and facilities that process or store it, and the rule is inheritance: an asset carries the highest classification of any data it handles. A laptop holding one Confidential file and a thousand Public ones is a Confidential asset, and it is stored, transported and destroyed as such.

Inheritance is also the logic of spillage: higher-classified data landing in a lower-classified system raises the whole system's classification until it is removed and the system verified clean, which is why a spill is an incident.

The label sets

The government sequence and its damage language are what the exam expects you to recognize. The commercial column is a convention, not a standard; organizations name their own levels, and a stem will happily use Restricted or Proprietary. What matters is the logic: levels ordered by impact, few of them, and a stated default for unlabeled data. Three or four levels is the practical ceiling; schemes with seven collapse because nobody can apply them consistently.

Over-classification is as damaging as under-classification, which is the point of the opening story. When most things carry the top label, the controls become unbearable, staff route around them, and the documents that genuinely need the label lose it in the crowd. The exam treats "default to the lowest defensible level" as correct and "when in doubt, mark it Confidential" as the failure.

What drives the grade

The criteria the outline names are value, sensitivity, age and regulation, and each is a question the owner asks.

• Value: what is lost commercially if this becomes public or is corrupted?
• Sensitivity: could disclosure cause distress, discrimination or physical risk to a person, or breach a promise to a customer?
• Regulation: does a law require particular protection? Personal, health and cardholder data and export-controlled technology arrive with their classification partly decided.
• Age: does the sensitivity decay? A quarterly result is market-sensitive until the announcement and public a minute later. Age is what makes declassification possible.

Two effects push a dataset above the grade of any record in it: aggregation, sensitivity arising from volume, as when a year of harmless shipment records reveals a customer's suppliers and margins, and inference, deducing protected facts from unprotected ones. Both are why an owner grades the collection, not just the row.

Who decides: the accountability chain

Classification is assigned by the data owner, a business role. Not the CISO, not the database administrator, and not the person who happened to create the file.

The data custodian operates the controls the owner specified: backups, permissions, encryption, retention enforcement. Custodians implement; they do not decide. The data steward is delegated by the owner for data quality, meaning and day-to-day classification questions; the steward advises, the owner stays accountable. The asset owner and system owner are the owner role applied to the item and the system, and an asset with no named owner is an unmanaged asset, however well configured.

The legal roles come from privacy law and sit on a different axis. The data controller determines the purposes and means of processing and carries the primary regulatory obligations. The data processor acts on the controller's documented instructions and has its own direct duties, including security and breach notification to the controller. The data subject is the individual the data is about, and their rights run against the controller. The exam's favorite trap is conflating owner with controller: owner is an internal accountability that decides classification and access; controller is a legal status that answers to a regulator. One organization is a controller for its own customer data and a processor for a client's, and who notifies the supervisory authority depends on which hat it is wearing.