Trying to protect every piece of data at the same level is both expensive and ineffective. Classification determines where protection should concentrate.
01. Number of Classes
Three or four classes are enough: public, internal, confidential and, if needed, strictly confidential. More than that creates confusion in practice and nobody picks the right label.
02. Ownership
Every data set needs a business owner. Access requests should be approved by the data owner, not by IT. Where IT is the approving authority, permissions widen uncontrollably over time.
03. Least Privilege
A user should reach only the data needed to do their job. In practice this is the most violated principle, especially in ERP implementations where broad roles are granted to make things easy.
04. Role Design
Permissions should be granted to roles, not people. When staff change, the role is handed over and no personal permission pile builds up. Where segregation of duties is required, conflicting roles must not combine in one person.
05. Regular Review
Permissions should be reviewed at least annually. Old permissions of staff who changed departments are among the most common audit findings.
06. The Leaver Process
All access for a departing employee should be closed the same day. Where this flow between HR and IT isn't automated, accounts can stay open for months.