The Information Protection Life Cycle and Framework: Acquire and Assess

The Information Protection Life Cycle (IPLC) and Framework outlines how information should be protected through three stages of its existence—acquire & assess, active use life, and disposition—supported by multiple categories of controls. The acquisition stage begins when information objects are created or obtained, making it the most effective point to perform analysis and classification. Information can originate through office automation tools, email, downloads, and other channels, so early controls focus on discovery and classification capabilities.

Information objects should be analyzed by content, semantics, criticality, and intended audience. Discovery often starts with on-premises servers and web applications, historically using custom scripts, but Data Leakage Protection (DLP) tools have become common for locating and securing unstructured files across on-premises systems and endpoints like desktops and laptops. Discovery must also extend to cloud environments, where sensitive information may reside in IaaS-hosted applications, collaboration platforms such as O365 SharePoint, file-sharing services like Box or Dropbox, and SaaS systems such as Salesforce. Cloud Access Security Brokers (CASB) enable visibility and policy enforcement for information sent to and accessed within cloud services.

Classification schemes vary by business policy and external requirements. Labels like “Proprietary,” “Restricted,” and “Confidential” are used differently across organizations, while regulated categories (e.g., export-controlled data, PII, PHI, financial and tax information) may require complex evaluation based on information attributes, user attributes such as nationality, and environmental attributes like location. Implementation differs for structured versus unstructured data: databases may require cell-level tracking via schema changes, while files can be tagged with metadata. Because inventories and classifications become outdated, periodic audits are necessary to discover new objects, reclassify assets, and remove invalid classifications.

• The IPLC defines three stages in the life of information objects: acquire & assess, active use life, and disposition.
• Discovery and classification tools are the initial controls applied during the acquire & assess phase.
• Information objects can be created in office automation tools or arrive via email, downloads, and other methods.
• DLP tools are used to discover unstructured data files on-premises and can also find and secure data on endpoints.
• Organizations store business-critical information in cloud services, including IaaS-hosted applications and SaaS platforms.
• CASB solutions detect when users access and send information to cloud services and support applying in-house security policies to those services.
• Businesses commonly classify information with labels such as “Proprietary,” “Restricted,” and “Confidential,” but definitions vary by organization.
• Export control regimes can require evaluating information classification along with user nationality and location attributes to determine permissible sharing.
• Structured data classification may require adding database rows, columns, or tables to track sensitivity at the cell level.
• Periodic audits are needed to identify new information objects and to reclassify or remove objects when prior classifications are no longer valid.

• “The Acquisition phase is an ideal time to analyze and classify information objects.”
• “Information objects should be analyzed and classified according to content, semantics, criticality, and intended audience.”
• “Discovery encompasses more than just on-premise storage, applications, and endpoints.”
• “Classification does not necessarily mean marking documents as ‘Top Secret’, although that is a use case.”
• “Organizations use these terms differently, depending on their individual policies.”
• “These classification models can be complex, and permissible sharing of such information requires evaluation of resource attributes (information classification) as well as user (nationality) and environmental (location) attributes.”
• “There are more tools available that can process unstructured data for discovery and classification compared to the number of tools available for analyzing information in databases, due to the complexity involved.”
• “Even though DLP and some classification tools pre-date the cloud, many have modernized to be able to work in IaaS and PaaS environments.”
• “However, CASB solutions are cloud-native.”
• “Information inventories / classification exercises cannot be one-time events or considered only at creation time.”