Data and Analytics Assessment

Data Classification and Handling Maturity Assessment

A maturity assessment of data classification and handling, from policy, impact-based levels and discovery through labeling, protection by level, cloud, SaaS and AI platforms to reclassification, monitoring and improvement.

Already have an account? Log in to start

At a glance

Questions: 53
Domains: 6
Working time: Initial assessment: 10 to 12 hours of facilitated sessions over two weeks with information governance, information security and DLP, two or three data owners, IT and cloud platform owners, AI platform owners and legal, starting with a 30-minute session with every area for the four all-area questions. Evidence gathering: the policy, standard, handling standard, program plan, inventory and discovery results, rule set, samples of labeled content and AI data sets, access and DLP rule extracts and performance reports. Reassessment: 5 to 6 hours.
Repeat: Annually, and after a new discovery or labeling platform, a major cloud or SaaS adoption, the rollout of AI assistants or agents over company data, a significant data incident or a change in the classification schemes the organization must follow.
Roles: 6
Updated: October 2026

Who it is for

Data Owners and Information Governance
Information Security
Legal, Privacy and Compliance
IT Platforms, Cloud and Applications
AI and Analytics Platforms
Process Owner/Full Model Assessor

Primary: CISO, head of information governance and the classification program lead. Secondary: data owners, information security and DLP teams, IT, cloud and application owners, AI and analytics platform owners, legal, privacy and compliance, and internal audit.

What you will gain

Shows where classification exists only on paper, where sensitive data is unknown or unlabeled, and where protection does not follow the label, including in AI tools. Gives the CISO and information governance a prioritized roadmap and gives DLP, privacy, records and AI teams a dependable label to build on.

About this assessment

Most organizations have a classification policy; far fewer can show that labels are applied consistently, that protection actually changes with the label, or that AI assistants and agents respect it. This assessment tests the full chain: a policy and a standard that set levels by business impact, owner approval and a usable decision guide, discovery that finds sensitive data across databases, files, cloud and SaaS, labels applied at creation, inherited by derived data and raised when data is combined, a handling matrix that sets what each level requires, and enforcement through access, DLP, encryption, masking, sharing, export and API controls. It gives particular weight to AI: data sets classified before training or retrieval, assistants and agents limited by label, AI-generated content marked, and labels following data into vector stores and agent memory. It is a deep dive in the ITSG data family and replaces Data Classification and Lifecycle v8.9.5. Retention, legal hold, archives and destruction now belong to Records and Information Management, residency to Privacy Program Operations and sharing agreements to Data Products and Data Sharing; this model tests those hand-offs only. The model is neutral to jurisdiction and vendor: laws and national classification schemes are mapped through the External Scheme Crosswalk by regional overlay models.

What we assess: 6 domains

Each domain is a group of related questions, scored on its own and rolled up into your overall result.

01 · 9 questions

1 Classification Governance and Taxonomy

Classification policy, the classification standard and impact method, owner approval, program plan, decision guide, regulated categories, external scheme mapping, exceptions, training

02 · 7 questions

2 Sensitive Data Discovery and Inventory

Automated discovery, structured data, dark data, cloud and SaaS scope, asset links, sensitive data flows, risk concentration

03 · 11 questions

3 Classification and Labeling

Labeling at creation, automated inspection, marking, override control, structured data, collaboration, inbound data, derived data, aggregation, AI-generated content, legacy remediation

04 · 11 questions

4 Handling and Protection by Level

Handling matrix, access by level, DLP hand-off, encryption, quantum-safe protection, sharing, publication, physical media, masking, bulk export, export-controlled data

05 · 6 questions

5 Cloud, SaaS and AI Platforms

Cloud baseline, SaaS labels, API enforcement, location rules by level, AI dataset classification, AI assistant and agent access

06 · 9 questions

6 Reclassification, Monitoring and Improvement

Reclassification and downgrade, label propagation to AI copies, retention hand-off, compliance monitoring, accuracy audit, incident triage, behavior monitoring, tool tuning, program reporting

KPIs to track

Measures that show whether the improvements hold.

KPI
Stores Scanned on Cycle - Share of in-scope data stores scanned within their defined discovery cycle. Target: at least 95%.
Label Accuracy - Share of sampled items carrying the correct classification. Target: at least 95%.
High-Level Stores Encrypted to Standard - Share of stores holding the two highest levels encrypted to the standard for their level. Target: 100%.
AI Data Sets Classified - Share of AI training, fine-tuning and retrieval data sets with a recorded classification before use. Target: 100%.
Overrides Reviewed on Time - Share of label downgrades and removals reviewed within five business days. Target: 100%.

Framework alignment

Questions are written in plain language and mapped to:

ISO/IEC 27001:2022
NIST SP 800-53 Rev 5
NIST SP 800-60 Vol. 1 Rev. 1
NIST CSF 2.0
COBIT 2019
NIST FIPS 203
NIST SP 800-88 Rev 2
ISO/IEC 42001:2023
NIST AI 100-4
C2PA Technical Specification 2.4
OWASP Top 10 for Agentic Applications 2026

Works best with

Practices this assessment relies on. Assessing them too gives a fuller picture.

Data Governance and Management (v1.9.6): owns the Data Management Policy, Data Ownership Register and Data Obligations Register; owners approve levels here and regulated categories come from the obligations register (1.1, 1.3, 1.6).

Metadata, Catalog and Lineage (v1.9.6): shows classification tags on catalog assets and provides lineage for sensitive data flows (2.6, 3.05).

Data Loss Prevention Operations (v8.9.6): owns the DLP Rule Catalog and Insider Risk Monitoring Standard and enforces labels at egress; this model tests the hand-off (4.03, 4.10, 6.7).

Master Data and Data Quality Management (v6.9.6) and Shadow AI Sprawl Governance (v3.9.6): use the Data Classification Standard owned here.

Security Operations (v8.9.6), API and Integration Lifecycle (v6.9.6), AI Governance (v11.9.6), Configuration Management (v9.9.6) and IT Asset Management (v6.9.6): own the incident standard, API design rules, AI data set and agent standards, CMDB and cloud and SaaS standard used here (6.6, 5.3, 5.5, 5.6, 2.5, 2.4).

Records and Information Management (v1.9.6), Privacy Program Operations (v1.9.6) and Data Products and Data Sharing (v1.9.6): own retention and destruction, residency rules and sharing agreements; this model tests the hand-offs only (6.3, 5.4, 4.06).

Recommended: Run after Data Governance and Management; run before Data Loss Prevention Operations, Privacy Program Operations and any rollout of AI assistants or agents over company data.