Find It, Label It, Keep Control After It Leaves: Data Discovery, Classification, and IRM on the CCSP Exam

The data register lists twelve regulated datasets. The first estate-wide discovery scan confirms all twelve, then finds loyalty extracts in a data-science bucket, identity numbers inside free-text delivery notes, payroll PDFs migrated into SaaS storage, and a database snapshot in a decommissioned account nobody can close because nobody owns it. None of it was on the register; all of it was the customer's responsibility. CCSP objectives 2.4 through 2.6 turn an assumed inventory into a real one and then into controls: discover, classify, label, enforce, and, for data that must leave, keep control anyway.

You cannot protect what you have not found

Discovery makes classification, retention, deletion and DLP possible, because each acts only on data it has been pointed at. The examinable core of objective 2.4 is the mapping from data form to technique.

If a stem describes free text or documents and an option proposes schema analysis, that option is wrong. Column profiling earns marks too: sixteen-digit values that pass the Luhn check are card numbers whatever the column is named.

Content, metadata, label: three ways to look

Three methods cut across the forms. Metadata-based discovery reads names, types and tags; it is fast and misses anything misnamed. Label-based discovery finds data by labels already applied; it is the fastest and exactly as good as the labeling was, so it confirms the known and never finds the unknown. Content-based discovery inspects the data itself and finds what the labels missed, at the price of false positives: a sixteen-digit order reference looks like a card until context says otherwise.

Application logs are a sensitive data store, and a reliable exam answer: debug logging of request bodies deposits regulated data into a store built for long retention and wide read access. Discovery must cover logs, and the fix is at the source.

Data location and data flow mapping

In cloud, data location is three questions. Which resources hold the data: every account, project and tenant, shadow ones included. Which jurisdictions: a region is a commitment about storage, while support, backup and telemetry paths may reach elsewhere. Which copies exist: snapshots, replicas, backups, development refreshes, partner shares. Copies are the usual gap between a discovery report and reality; the storage types that breed them are in our post on cloud storage architectures. Data flow mapping follows the data through those questions over time.

The cloud changes discovery in four ways the exam tests: it must be continuous and event-driven, triggered on resource creation and object write, because a quarterly scan describes an estate that no longer exists; it must cover the whole organization, shadow accounts included; it should prefer provider-native scanning, which reads data at rest without egress cost; and its output must feed classification and DLP, with an owner and a deadline for each finding.

Classification: sensitivity, categories, and who decides

Classification and categorization are two axes candidates conflate. Classification is sensitivity and required handling on a short ordered scale, four levels at most, because a seven-level scheme gets applied as one level by everyone. Categorization is type and regulatory character. A record is classified once and may carry several categories, and the categories decide which statute applies: a loyalty record is restricted and simultaneously personal data.

The data owner classifies, approves access and sets retention; the custodian, usually IT, implements the controls the classification demands; the steward looks after quality and consistent use; security advises and monitors. An option in which IT or the security team decides the classification is wrong.

Two rules make hard questions. Aggregation: one store's daily takings are internal, three years of every store's takings is commercially significant, and joining datasets triggers reassessment at no less than the higher level. Inference: a model that infers a medical condition from purchase histories produces health data; derived data is classified on what it reveals.

From label to control

A label carries the classification with the data, and in cloud the label is usually a tag. Resource tags on the bucket, volume or project have the highest enforcement value because provider policy engines condition on them; object tags let discovery write findings back; embedded document labels travel with the file and drive usage rights, the bridge into IRM; column labels drive the masking in our post on encryption, tokenization and masking.

The moment access, encryption or retention depends on a tag, the ability to change the tag is the ability to change the control. Restrict modification to a few roles, log every change, alert on downgrades, and fail closed: an untagged resource is treated as the highest classification and blocked, never as public.