---
title: "Examples of Various Classification Label Types"
url: "https://dm0bkdes5q7a2ls.productfruits.help/en/article/examples-of-various-classification-types"
language: "en"
last_updated: "2026-09-24T16:52:46.237Z"
---

# Examples of Various Classification Label Types

In the Spirion Sensitive Data Platform (SDP), classification labels are used to mark and govern data based on its sensitivity. While customers can create any custom labels they need, they typically follow established security frameworks or regulatory requirements.

Commonly used classification labels include the following:

## **1\. Standard Sensitivity Tiers (Out-of-the-Box)**

Most organizations start with a 3 or 4-tier model to align with internal security policies:

-   **Top Secret / Highly Confidential:** For the most sensitive data (for example, trade secrets, executive-level strategy).
-   **Confidential:** For data that requires protection but isn't "Top Secret" (for example, employee records, internal financial reports).
-   **Restricted / Internal Use:** For data intended only for employees but with lower risk if exposed.
-   **Public:** For data that has no sensitivity and can be shared outside the organization.

## **2\. Regulatory & Compliance Labels**

Customers often create labels that map directly to the regulations they must follow:

-   **PCI / PCI-DSS:** For files containing credit card numbers or cardholder data.
-   **HIPAA / PHI:** For Protected Health Information or medical records.
-   **GDPR / PII:** For Personal Identifiable Information related to EU citizens.
-   **CCPA:** For data subject to the California Consumer Privacy Act.
-   **SOX:** For financial data subject to Sarbanes-Oxley audits.

## **3\. Departmental or Project-Specific Labels**

Larger organizations may use labels to identify data ownership or specific high-risk projects:

-   **HR-Sensitive:** For payroll, performance reviews, and hiring documents.
-   **Legal / Attorney-Client:** For privileged legal communications.
-   **Finance:** For tax documents and audit workpapers.
-   **Project \[Codename\]:** For proprietary research or pre-release product info.

## **How these labels are applied**

Spirion can apply these labels in three primary ways:

1.  **MIP Labels:** Integrating directly with the **Microsoft Information Protection** ecosystem to apply labels that Microsoft Office and other tools recognize.
2.  **In-Content Classification:** Writing the classification directly into the metadata of M365 files.
3.  **NTFS ADS:** Writing the classification to the **Alternate Data Stream** of a file on a Windows server, which tags the file without changing its primary content.

## **Recommendations**

When setting up classification, best practice is a **"Crawl, Walk, Run"** approach:

-   **Crawl:** Use "[Notify](https://https//dm0bkdes5q7a2ls.productfruits.help/en/article/add-a-new-scan-playbook#how-to-notify-assignees-of-scan-playbook-results)" actions first to see what would have been classified.
-   **Walk:** Apply "Internal Use" or "Public" labels to low-risk data.
-   **Run:** Automate "Confidential" or "Restricted" labels for high-confidence matches (like Social Security numbers or Credit Card numbers) using [Scan Playbooks](https://dm0bkdes5q7a2ls.productfruits.help/en/article/add-a-new-scan-playbook).

## High-Level Examples of Classification Labels by Type

See below for **examples** of the following Classification label types:

-   **LEGA - Legacy**
-   **PREF - Preference**
-   **PROC - Process**
-   **PURP - Purpose**
-   **REG - Regulatory**
-   **SENS - Sensitivity**
-   **CUSTOM**

| Classification Name | Type / Category | Description / Scope | Example UUID / GUID |
| --- | --- | --- | --- |
| CCPA | **Regulatory** (`REG`) | California Consumer Privacy Act compliance scope. | `c769ef64-b44e-4e71-bac2-2192f2bfb22e` |
| CUI | **Regulatory** (`REG`) | Controlled Unclassified Information (federal/defense standards). | `44b87f03-f1d3-4bde-ba8a-60a1f8275577` |
| FERPA | **Regulatory** (`REG`) | Family Educational Rights and Privacy Act (student records). | `8a5427e3-2014-4f9d-a5c2-4bb7a20325b3` |
| GDPR Article 9 | **Regulatory** (`REG`) | Special categories of personal data (biometric, health, genetic). | `7d9db169-90e2-4e39-b62d-472af3fce58e` |
| Claims Mgmt | **Purpose** (`PURP`) | Data collected/processed for insurance or warranty claim workflows. | `72608500-a219-4912-b0db-184268c1c4b2` |
| Finance | **Purpose** (`PURP`) | Accounting, invoicing, payroll, or banking records. | `bc6a9163-b85f-4a00-960c-bbefd51c2587` |
| CocaCola | **Process** (`PROC`) | Client-, partner-, or project-specific process content (*CocaCola Content*). | `f89a1b1c-9c65-44d7-9a56-7ef584df097d` |
| Contoso | **Process** (`PROC`) | Enterprise vendor or customer account operations (*Contoso Content*). | `fe6dcc61-7b74-4e34-8ca8-2c772dab12a1` |
| Disney | **Process** (`PROC`) | Media, licensing, or partner processing stream (*Disney Content*). | `d35824cc-c5d5-4aa4-97cc-785ce853e2b9` |
| Confidential | **Internal** (**`Custom`**) | Baseline non-public organizational information. | `ec810f3b-46da-4c45-a9e4-37a18a4c7f8b` |
| Critical | **Internal** (**`Custom`**) | High-impact organizational assets and infrastructure records. | `3622f514-9596-423e-9d76-78f5d80db6a4` |
| `Embargo 23Jul31` | **Sensitivity** (`SENS`) | Time-bound sensitive disclosures (*Embargo data until July 31, 2023*). | `bd361a94-7183-4f6f-8442-3eaec7261b3c` |
| `Government Form` | **Sensitivity** (`SENS`) | Official government forms, tax schedules, or regulatory filings. | `cc5955d7-d4eb-4272-9842-b1bf6998e8f1` |
| `ePHI` | **ePHI** (**`Custom`**) | Electronic Protected Health Information (HIPAA security rule). | `ec9b7dfa-73d4-4023-aad9-c277ad18e3c8` |
| `Classified` | **Legacy** (`LEGA`) | Retained legacy labels migrated from previous system versions. | `3f95feab-0e4e-4a62-8214-c2cffebca339` |
| `GLBA Regulated Data` | **Legacy** (`LEGA`) | Gramm-Leach-Bliley Act financial privacy labels. | `14c74c4c-16f3-4edf-a080-8b5bd0e0248b` |

### LEGA - Legacy Classification Label Type Examples

![](https://docs.spirion.com/Content/Resources/Images/LegacyExample.png)

### PREF - Preference Classification Label Type Examples

![](https://docs.spirion.com/Content/Resources/Images/ClassificationPREF.png)

### PROC - Process Classification Label Type Examples

![](https://docs.spirion.com/Content/Resources/Images/ClassificationProcess.png)

### PURP - Purpose Classification Label Type Examples

![](https://docs.spirion.com/Content/Resources/Images/ClassificationPurpose.png)

### REG - Regulatory Classification Label Type Examples

![](https://docs.spirion.com/Content/Resources/Images/ClassificationReg.png)

### SENS - Sensitivity Classification Label Type Examples

![](https://docs.spirion.com/Content/Resources/Images/ClassificationSens.png)

### CUSTOM Classification Label Type Examples

![](https://docs.spirion.com/Content/Resources/Images/ClassificationCUSTOM.png)

## Detailed Examples of Classification Labels

### What data would the PURP classification “IT Mgmt” contain?

In **Spirion Sensitive Data Platform (SDP)** and enterprise data governance frameworks (such as GDPR Article 30 Records of Processing Activities / RoPA), `PURP` stands for **Purpose of Processing**.

The `IT Mgmt` (*Information Technology Management / IT Operations*) classification identifies data collected, generated, or processed specifically to **operate, administer, secure, monitor, and maintain the organization's IT infrastructure, endpoints, and corporate networks**.

#### Key Data Categories & Examples under "IT Mgmt"

The `IT Mgmt` classification typically contains the following types of operational and administrative data:

**1\. Identity, Directory & Access Management (IAM)**

Data used to provision, authenticate, and manage employee system access:

-   **User Accounts & Profiles:** User Principal Names (UPNs), employee usernames, SAMAccountNames, Active Directory / Entra ID Object IDs, and email addresses.
-   **Access Control Lists (ACLs):** Group memberships, role definitions (RBAC), and folder/share permissions.
-   **Credentials & Secrets (Staged/Discovered):** Service account records, SSH public keys, API tokens, PKI/SSL certificate metadata, and password change audit timestamps.

**2\. IT Service Desk, Support & Ticketing**

Data generated when employees request technical assistance or report issues:

-   **Service Requests & Incident Tickets:** Jira Service Management, ServiceNow, or Zendesk ticket records (e.g., hardware requests, access requests, bug reports).
-   **Workstation Imaging & Provisioning Records:** Laptop assignment logs, user workstation migration sheets, and device checkout forms.
-   **Support Attachments & Screenshots:** Error dumps, system diagnostic exports, or user-submitted screenshots containing machine configurations.

**3\. Asset & Configuration Management (CMDB / HAM)**

Inventory data describing the organization’s hardware, virtual machines, and cloud environments:

-   **Hardware Details:** Hostnames, MAC addresses, serial numbers, BIOS versions, and asset tags.
-   **Network Allocations:** Static IP address assignments, DHCP reservation tables, and subnet configurations.
-   **Software Asset Management:** Installed software inventories, software license keys, version tracking, and patch compliance levels.

**4\. Network, Security & System Logs (Audit & Telemetry)**

Operational logs generated by servers, firewalls, and security agents:

-   **Authentication Logs:** Successful and failed login attempts, MFA challenge logs, and VPN session timestamps.
-   **Traffic & Gateway Telemetry:** DNS query logs, firewall connection logs, proxy traffic traces, and NetFlow metrics.
-   **Endpoint Telemetry:** EDR/antivirus scan logs, agent heartbeats, system event viewer exports, and OS crash dumps.

**5\. IT Vendor, Licensing & Contract Records**

Administrative documentation required for IT operations:

-   **Vendor Support Contracts:** Maintenance agreements, SLA terms, and support portal contacts with vendors (e.g., Microsoft, AWS, Cisco).
-   **Enterprise License Agreements (ELAs):** Software entitlement counts, product keys, and renewal schedules.

**Why Classifying Data as "IT Mgmt" Matters**

1.  **GDPR / Privacy Justification (Article 6):**
2.  -   IT management data is typically processed under the legal basis of **"Legitimate Interest"** (ensuring network and information security) rather than explicit consent.
3.  **Distinct Retention Schedules:**
4.  -   IT operational logs and tickets have specific retention limits (e.g., 90 days for firewall logs, 1–3 years for ticketing history) compared to financial or HR records that may require 7+ years of retention.
5.  **Targeted Security & Access Rules:**
6.  -   Prevents operational system data (e.g., network architecture diagrams or credential exports) from being stored in unprotected general-access file shares.

### What data would the PROC classification “Stale” contain?

In **Spirion Sensitive Data Platform (SDP)** and enterprise data governance frameworks, `PROC` stands for **Process / Processing Lifecycle State**.

The `Stale` classification identifies **dormant, inactive, obsolete, or orphan data** that has not been accessed, modified, or actively used within a defined organizational threshold (e.g., no read/write activity for $> 1$, $3$, or $5\\text{ years}$), yet continues to sit exposed in production or general storage repositories.

#### Key Data Categories & Examples Under "Stale"

The `PROC - Stale` classification typically flags the following types of data across file servers, cloud object stores, collaboration suites, and databases:

**1\. Inactive & Former Employee Repositories (Orphaned Data)**

Files, folders, and personal archives left behind after employees or contractors depart the organization:

-   **Unmanaged User Directories:** Former employee home shares (`\\fileserver\users\jdoe_archive`) containing old spreadsheets with customer details or payroll information.
-   **Orphaned OneDrive / Personal Cloud Drives:** Cloud storage accounts of deactivated users containing sensitive spreadsheets and personal notes untouched for years.
-   **Archived Local Desktop Backups:** PST email archive files (`archive2018.pst`) or workstation backup images stored on network drives.

**2\. Abandoned Project Artifacts & Completed Engagements**

Deliverables, source material, and operational records from historical business initiatives:

-   **Concluded Client Engagements:** Proposals, client onboarding documents, and statement-of-work spreadsheets for contracts completed years ago.
-   **Decommissioned Product Line Documentation:** Engineering requirements, architectural diagrams, and test customer datasets for retired applications.
-   **Legacy Vendor Evaluations:** RFPs, vendor risk assessment questionnaires, and third-party security audits from past procurement cycles.

**3\. Outdated Staging Dumps, Ad-Hoc Exports & Temp Files**

Transient or intermediate files created for one-off operations that were never cleaned up:

-   **Manual Database Exports:** Old database CSV dumps or SQL scripts (`prod_customer_export_2020.csv` or `user_table_backup.sql`) left on shared file shares.
-   **Migration Staging Folders:** Temporary folders created during cloud/server migrations that still hold duplicate copies of production data.
-   **Unused Log Archives & Crash Dumps:** Historical application debug logs or memory dumps containing unmasked sensitive tokens or user inputs.

**4\. Expired Retention Compliance Records**

Records that have passed their statutory retention schedule and should legally be pruned:

-   **Expired Job Applicant Resumes:** Resumes and background check files from hiring requisitions closed years prior (often exceeding GDPR / EEOC retention limits).
-   **Superseded Financial / Tax Schedules:** Supporting worksheets from audit periods exceeding the statutory 7-year retention requirement.
-   **Expired NDA / Legal Agreements:** Expired non-disclosure agreements and contracts where the active terms and legal hold requirements have elapsed.

**Why Classifying Data as "Stale" is Critical**

1.  **Minimizes Breach Exposure (Shrinks Attack Surface):**
2.  -   Stale data is a primary target in ransomware and exfiltration attacks because it is rarely monitored by data owners.
3.  **GDPR / Privacy Principle of Storage Limitation (Article 5(1)(e)):**
4.  -   Privacy laws require that personal data be kept in a form which permits identification of data subjects for **no longer than is necessary** for the purposes for which it is processed. Tagging stale data enables automated compliance purging.
5.  **Reduces Storage Costs & Cloud Footprint:**
6.  -   Identifying stale repositories allows IT teams to tier data to cheaper cold storage (e.g., AWS S3 Glacier, Azure Archive) or delete ROT (Redundant, Obsolete, Trivial) data entirely.
7.  **Triggers Automated Remediation Playbooks:**
8.  -   When Spirion finds high-sensitivity data (e.g., SSNs or credit cards) combined with the `PROC - Stale` tag, it can trigger automated playbooks to **Quarantine**, **Restrict Access**, or **Shred** the file.

### What data would the REG classification “CUI” contain? Give examples

In **Spirion Sensitive Data Platform (SDP)** and federal/defense data governance frameworks, `REG` stands for **Regulatory Classification**.

The `CUI` classification identifies **Controlled Unclassified Information**—government-created or government-owned information requiring safeguarding or dissemination controls pursuant to applicable laws, regulations, and government-wide policies (specifically **32 CFR Part 2002**, **NIST SP 800-171**, and **DoD CMMC** requirements).

#### Key Data Categories & Examples under "CUI"

The National Archives and Records Administration (NARA) CUI Registry divides CUI into specific categories. In enterprise repositories, file shares, and collaboration systems, the `REG - CUI` classification typically covers:

**1\. Defense & Controlled Technical Information (CTI / CDI)**

Unclassified technical data with military or space application:

-   **Engineering & Architectural Schematics:** CAD/CAM technical drawings, blueprints, circuit designs, and specifications for defense hardware, weapon components, or military vehicles.
-   **Research & Development Data:** Experimental test results, algorithm source code, simulation datasets, and aerodynamic models developed under government/defense contracts.
-   **Operational Runbooks & Manuals:** Maintenance procedures, software architecture documentation, and system deployment specs for government mission platforms.

**2\. Export-Controlled Data (ITAR & EAR)**

Technical information subject to United States export regulations:

-   **International Traffic in Arms Regulations (ITAR):** Technical data directly related to defense articles and defense services on the United States Munitions List (USML) (e.g., guidance system algorithms, naval propulsion specifications).
-   **Export Administration Regulations (EAR):** Dual-use technical specifications, commercial encryption source code, and hardware manufacturing tolerances listed on the Commerce Control List (CCL).

**3\. Procurement, Acquisition & Source Selection Data**

Sensitive commercial and contracting information generated during government procurement:

-   **Proposal & Bid Documents:** Cost/pricing data, technical proposals, subcontractor fee structures, and competitive bid scoring sheets.
-   **Source Selection Sensitive Information:** Evaluator scorecards, government cost estimates (IGCE), contractor evaluation matrices, and contract award deliberations prior to public announcement.
-   **Contract Deliverables:** Performance reports, statement-of-work (SOW) execution tracking, and proprietary subcontractor deliverables.

**4\. Critical Infrastructure & Homeland Security Information**

Information related to physical or cyber assets vital to public safety and national resilience:

-   **Energy, Grid & Water Schematics:** SCADA/ICS architectural network diagrams, power grid vulnerability assessments, pipeline route maps, and facility physical security plans.
-   **Emergency Operations & Evacuation Plans:** Government continuity-of-operations (COOP) plans and critical facility blueprints.

**5\. Legal, Law Enforcement & Investigation Records**

Sensitive materials compiled for law enforcement or administrative enforcement purposes:

-   **Law Enforcement Sensitive (LES):** Incident investigation files, witness interview transcripts, confidential informant identifiers, and forensic analysis reports.
-   **Privacy & Federal PII:** Personnel security clearance background investigation records (e.g., SF-86 forms), fingerprint records, and federal employee medical/tax files held by contractors.

#### Why Classifying Data as "CUI" is Critical

1.  **Mandatory Compliance (CMMC & NIST SP 800-171):**
2.  -   Government contractors handling CUI must demonstrate compliance with **NIST SP 800-171** controls and **CMMC Level 2/3** certification under DFARS 252.204-7012.
3.  **Access Control & Safeguarding (ABAC / Need-to-Know):**
4.  -   CUI cannot reside on unmanaged personal drives or open company file shares. Discovering and tagging CUI allows security teams to enforce Attribute-Based Access Control (ABAC), ensuring access is restricted strictly to authorized US persons / clearance holders.
5.  **Automated Protection & Encryption:**
6.  -   Tagging data with `REG - CUI` enables automated integration with tools like **NC Protect** and **Microsoft Purview** to apply encryption at rest, inject dynamic visual watermarks (e.g., `CUI // SP-CTI // FED ONLY`), and block unauthorized external egress or downloads.
7.  **Audit Readiness & Spill Response:**
8.  -   Pinpoints all repositories storing federal contract data, simplifying reporting during defense contract audits (DCMA / DIBCAC) and enabling rapid containment if data is inadvertently placed in an unaccredited environment.