Data Classification – Boldon James Solution

ISO 27001 requires organizations to define a data classification approach, typically within a documented information security policy. Data classification categorizes information assets by sensitivity and regulatory impact, enabling appropriate handling and protection. A common model is the Traffic Light Protocol (TLP), ranging from RED (top secret, shared only with named recipients and often verbally) through AMBER (restricted, need-to-know within an organization), GREEN (internal community-wide but not public), and WHITE (public, freely distributable under copyright rules). Extending classifications into metadata tags allows technical enforcement across systems such as file stores, email, cloud gateways, and related controls.

Many data types merit classification, including PCI data, SOX-relevant data, breach-reportable data, personal and sensitive personal information under data protection law and the EU-wide GDPR (from 25 May 2018), pre-patent materials, proprietary corporate information, IPR-protected designs and drawings, share price sensitive information, and ITAR-controlled data. The text argues that classification is not “one size fits all,” cannot be purchased as an off-the-shelf solution, and is not automatically embedded into standard office tools by default.

The Boldon James Data Classification suite is positioned as a configurable toolset designed to align with an organization’s classification schema and ways of working, ideally deployed top-down but adaptable to smaller scopes. It supports multiple classification methods, from user-driven labeling and endorsements to rule-based defaults and automated classification at creation, in transit, or at rest. Its competitive advantage is broad integration (Microsoft Office and related platforms, IBM Notes, macOS Office, CAD tools) and interoperability with DLP, analytics, and data governance solutions, plus automated endpoint deployment options. Implementation requires licensing, maintenance, configuration effort, training, support processes, and a plan for legacy data, especially as cloud usage expands.

• ISO 27001 defines the need for data classification.
• The Traffic Light Protocol includes RED, AMBER, GREEN, and WHITE categories for information sharing.
• RED information is limited to named recipients and is commonly shared verbally or in person.
• AMBER information is shared within an organization on a need-to-know basis with originator-defined limits.
• GREEN information can circulate within a community but must not be posted publicly or released outside the community.
• WHITE information may be distributed freely without restriction, subject to standard copyright rules.
• Boldon James licenses its suite per user with volume breaks and offers perpetual and rental licensing options.
• Annual maintenance is expected at 25%.
• The suite integrates with DLP vendors including Symantec, Intel Security/McAfee, Forcepoint, and Digital Guardian.
• Reported outcomes include a 60% improvement in user security awareness at Allianz and a 90% reduction in email data loss egress at Ofgem after implementing Classifier.

• “Data Classification is an important step to building a secure organization.”
• “One size does not fit all.”
• “It’s not something you can buy a box ‘off-the-shelf’.”
• “Data Classification [is not] automated (by default) into any of the standard tools in regular office use within companies today.”
• “Data classification in most organizations works best when driven top-down.”
• “Users are empowered to make business-centric classification decisions.”
• “Intelligent defaults and rules recommend a classification to the user.”
• “Data is automatically classified without user involvement – on creation / in transit / at rest.”
• “Thus most of the suite’s tools have the ability to be deployed automatically.”
• “Data classification done properly is not easy – there is no silver bullet (or magic box).”