---
title: "How to Classify Sensitive Data"
url: "https://dm0bkdes5q7a2ls.productfruits.help/en/article/how-to-classify-sensitive-data"
language: "en"
last_updated: "2026-02-25T16:41:42.226Z"
---

# How to Classify Sensitive Data

Use the information in this article to help you classify sensitive data.

Use the following archTIS guidelines and recommendations when classifying sensitive data.

-   Note that classification is a multi-step process.
-   Classification is not something that is setup for your entire environment and performed in one attempt.

## Establish a Classification Schema - Start with what you know

-   Keep your classification schema simple
-   -   Layer upon layer of classifications can lead to confusion
    -   Classifying data as "not-sensitive" is simple and often overlooked, but can be very useful
    -   Don't use complex naming conventions
-   Avoid over-labeling
-   -   Use labels and terms users can understand and which are easily defined
-   Create a checklist for each data type
-   -   Which data types are provided - Spirion data types (Social Security number, credit card number, phone number, etc.)?
    -   Which data types are missing and must be created (custom data types)?
    -   -   Custom data types are created by you
        -   Custom data type examples include: keywords, sensitive data definitions, regular expressions, dictionary data types, etc. such as: AWS Access Key Keyword - Pattern, CUI, EIN, ePHI, HSA Number, HSA Validator, IMEI, IPv4, IPv6, mother's maiden name, Asana client secret, etc.

![](https://cdn-assets.productfruits.com/c5440146-2ec5-4790-90e4-4ce0fe383aa5)![](https://cdn-assets.productfruits.com/dd564bc7-fd23-424c-885b-8adaa851a0a4)

-   Leverage **Sensitive Data Definitions** - Existing Spirion or Custom data types such as Social Security number, credit card number, phone number, IMEI, ABN, etc.
-   Below is an example of a custom data type called "PII" (personally identifiable information), which contains multiple native, Spirion-provided data types

![PII data type example with definition logic](https://cdn-assets.productfruits.com/59bfb57b-b66c-422c-8a0f-e661beaa7a2d)

## Limit the Scope of What is Classified

-   To start, apply classifications to the data in your Spirion database
-   -   Examine the senstive data (SSN, CCN, etc.) in the files your scans have discovered and decide how the sensitive data should be classified
    -   Next, decide how to classify the files which contain the sensitive data
    -   Lastly, what are the logical remediation steps to take on this data? Redact, shred, notify users? Is classifying the data or file the final step?
-   Choose a group or department to test your classification schema on such as HR, Finance, a small database, or onedrive account, etc.
-   Decide on a reasonable level of error and understand thresholds

## Test Your Classifications Before Deploying Them Across Your Environment

-   Understand the service tasks related to classifications and workflows
-   Start with easy operators - Equals, Greater Than
-   Apply classifications to Spirion database file records first, and later to the files themselves: the setting which controls this option in Scan Playbooks is shown in the screenshot below.
-   When the file itself is classified, the classification is embedded into the file's metadata and follows the file wherever it goes  
      
    ![](https://cdn-assets.productfruits.com/4e383ecc-2ffa-409f-b3d9-a00629827bdb)