Data classification matrices

Identifies matrices that map data or information categories to classification levels and handling controls. Topic phrases are retained for discovery; enforcement requires multiple matrix-column or control headings, and high confidence also requires a populated category-to-classification mapping.

Type

regex

Engine

boost_regex

Confidence

medium

Confidence justification

Medium confidence requires several matrix-schema or handling fields rather than generic classification language. High confidence adds a populated category-to-level relationship.

Detection quality

Topic verified

Jurisdictions

global

Regulations

GDPR

Data categories

security

Scope

wide

Risk rating

5

Platform compatibility

Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Degraded, Netskope: Unsupported

Pattern

(?is)\b(?:data\s+classification\s+matri(?:x|ces)|information\s+classification\s+matri(?:x|ces)|data\s+sensitivity\s+matri(?:x|ces)|sensitivity\s+classification\s+matri(?:x|ces)|classification\s+and\s+handling\s+matri(?:x|ces))\b

Corroborative evidence keywords

data category, classification level, handling requirement, access restriction, encryption required, OFFICIAL, OFFICIAL:Sensitive, PROTECTED, SECRET, TOP SECRET, CABINET-IN-CONFIDENCE, NOFORN, REL TO, ORCON, National Cabinet, AUSTEO, [object Object], Sensitive: Legal, Sensitive: Personal Privacy, Sensitive: Legislative Secrecy (+11 more)

Proximity: 500 characters

Should match

• Data classification matrix — Low-tier probe - matrix topic without schema or populated mappings
• Data classification matrix: Data category | Classification level | Handling requirement | Access restriction — Medium-tier probe - substantive matrix schema without a populated mapping row
• Data classification matrix: Data category | Classification level | Handling requirement | Access restriction; Data category: Customer records | Classification level: Confidential — High-tier probe - matrix schema with a populated category-to-level mapping

Should not match

• Enterprise data inventory: information asset, data owner, data steward, system of record, and data lineage — Data inventory content belongs to the adjacent inventory SIT
• Data retention and deletion schedule: information type | retention period | disposal method | legal hold — Retention schedules are not classification matrices
• Role-based access control matrix: role | system | permission | approval status — Entitlement matrices do not map data categories to sensitivity levels
• The machine-learning report shows a confusion matrix for data classification accuracy. — Statistical model evaluation must not collide with governance matrices
• Training example: Data classification matrix; Data category | Classification level | Handling requirement; Data category: Customer records | Classification level: Confidential — Explicit training content must not enforce even with a realistic populated row

Known false positives

• Classification policies, glossaries, and DLP product documentation discuss levels, labels, handling, encryption, and access without containing a matrix. Mitigation: Require an explicit data, information, or sensitivity classification matrix plus several independent matrix fields.
• Data inventories, retention schedules, role-access matrices, and machine-learning confusion matrices use overlapping data, classification, matrix, owner, and control terms. Mitigation: Exclude those generic anchors from the primary and reserve high confidence for a populated information-category to classification-level relationship.
• Training and policy templates can include realistic matrix columns and populated demonstration rows. Mitigation: Reject explicit template, demo, tutorial, sample-data, and training-example framing from enforcing tiers.

References

• https://www.oaic.gov.au/privacy/australian-privacy-principles-guidelines
• https://www.protectivesecurity.gov.au/