Security classification for documents

Profitability of organizations is ultimately dependent on the effectiveness with which they exchange, gather, process, retrieve, link, control, share, manage and, above all, protect their data and information. All these processes, however, require that the right information be made available to the right person or persons at the right place and at the right time. Costly lessons learnt with regard to information security controls introduced over the past number of years made it abundantly clear that it was vital, especially in a commercial environment, circumspectly and discreetly to apply countermeasures for the protection of information. A widely used mechanism with which to determine appropriate and effective countermeasures for the protection of information is to classify the said information. Most modern organizations classify their transaction-based data, for example 3, that information generated by orders and invoices, for the purposes of access control. The question that arises, however, is this: How many organizations classify their written communication, i.e. that contained in documents? All the information contained in documents represents the transaction-based data of an organization, and has a far more critical impact on its profitability than any other security factor. This paper has as its object the laying down of guidelines for the security classification of such documents. Documents are, by definition, mostly used as vehicles for the exchange of information not only within, but also between and among organizations. Important fundamentals on which this paper is based are as follows: the security requirements of specific categories of documents, the various processing stages of documents, such as draft and final, and the contents and structure of documents. In addition, the concept of information capability will be introduced. (The term ''information capability'' imports the ''amount'' of information added to the data already contained in a document by means of the structural properties of that document.) The model that will be devised on the strength of this paper will promote the consistent classification of documents and is intended for integration with commercial software products that command document processing capabilities, for example, document management systems and groupware.