TL;DR — Key Takeaways
- Know your data's classification before storing or sharing it — use the P1–P4 framework below.
- P4 data (HIPAA, SSNs, payment cards) requires special handling, MFA, encryption, and explicit approval.
- When in doubt, treat data as P3 or higher — it's always safer to over-protect than under-protect.
- Each solution's IT Nutrition Label carries the sharing guidelines for that specific platform.
- Your UISL classifies your department's data with you; a formal list of data types is expected by October 2026.
1. Framework Overview
The Data Classification Standard establishes a unified framework for categorizing and protecting institutional information across CMC and the Claremont Colleges consortium. Classifying data correctly determines the security controls, storage requirements, and sharing permissions that apply to each dataset.
The standard uses a Protection Level scale of P1 through P4, where P1 is public and P4 is the most highly restricted. This framework is formally integrated into CMC's governance structure alongside the Information Security Policy.
2. Classification Levels
The table below summarizes all four protection levels. Use it as your quick reference when deciding how to store, share, or handle any piece of institutional data.
3. How Data Gets Classified
CMC follows the University of California’s approach in a deliberately lightweight form: data is classified by type, not file by file. Once a data type — student advising notes, donor records, facilities work orders — is assigned a protection level, every instance of that type inherits the same controls. Departments never have to triage individual documents.
The classification work happens in the departments that own the data, because that is where the expertise lives:
- Unit Information Security Leads (UISLs) lead the effort for their area. UISLs are typically members of the IT Steering Committee.
- Subject matter experts in each department work with their UISL to list the data types the department actually handles and propose a protection level for each one.
- ITS consults on anything unclear. Edge cases, regulated data, and disagreements come to ITS — email help@cmc.edu and the request will be routed to the security team.
- ITS records the result. Agreed classifications go into a single institutional list so the same data type is treated the same way in every department.
While a data type is still under review, treat it at the higher of the levels under consideration. Over-protecting costs a little convenience; under-protecting can be a reportable incident.
Timeline. ITS expects to have a preliminary formal list of data types and their classifications by October 2026. It will be published here and reviewed on the same annual cycle as this standard. Until then, use the P1–P4 table above and ask ITS when a data type is not an obvious fit.
4. Data Handling Guidelines
Your classification level determines how you must treat the data day-to-day:
- P1 (Public) — Can be freely shared. No special protections needed.
- P2 (Internal) — Share with the CMC community. Avoid public posting without review.
- P3 (Confidential) — Share only on a need-to-know basis. Encrypt in transit and at rest. Use approved channels, never personal email.
- P4 (Highly Restricted) — Share only with explicitly authorized personnel. Requires MFA, encryption, and access logging at all times.
5. Storage Requirements
- P3 and P4 data must be stored on approved platforms only — Box (with authentication), OneDrive, or secured SharePoint
- Personal storage — USB drives, personal Google Drive, Dropbox, or iCloud — is prohibited for P3 and P4 data
- Data retention schedules apply based on classification level and regulatory requirements
- DLP (Data Loss Prevention) tools actively monitor and block unauthorized transmission of P3+ data
6. Sharing Permissions
- Use institutional Single Sign-On (CMC SSO) for all access controls — no anonymous or unauthenticated sharing of P2+ data
- External sharing of P3 or P4 data requires manager approval before sharing
- The consortium sharing framework ensures alignment across all five Claremont Colleges
- When sharing P4 data with vendors, a Business Associate Agreement (BAA) or Data Use Agreement (DUA) is required
Per-platform sharing guidelines live on the solution page. Every solution in the IT Solutions catalog carries an IT Nutrition Label in its sidebar that states the highest data classification the platform is approved for, how it authenticates, and any sharing restrictions specific to it. Check the label before you put institutional data into a tool — the guidance there is authoritative for that platform and may be stricter than the general rules above.
7. Compliance & Enforcement
Regular audits verify that data is classified and stored appropriately. Non-compliance may result in loss of system access and disciplinary action. The Exception Policy provides a pathway for legitimate use cases that conflict with standard classification rules.
8. Getting Started
- Identify your data — what type of institutional information do you handle?
- Classify it — apply the P1–P4 framework based on sensitivity and regulatory context, working with your UISL (see How Data Gets Classified)
- Store it properly — use the approved platform for your classification level
- Share it responsibly — follow the sharing guidelines for your data's level
- Review regularly — data classification may change as circumstances evolve