Security Classification (CIA / BIV)¶
Organisations often ask for a classification of your workload when you onboard. It sets how strict the controls must be. The model is CIA; in Dutch organisations BIV.
| Aspect | Question |
|---|---|
| Confidentiality (Vertrouwelijkheid) | What happens if unauthorised people read this? |
| Integrity (Integriteit) | What happens if data is changed or corrupted? |
| Availability (Beschikbaarheid) | How long can the system be down? Is there direct impact on the primary process? |
Each aspect gets a level:
| Level | Meaning | Typical examples |
|---|---|---|
| Low | An incident has no real impact | Public information, test and development without production data |
| Moderate | Limited impact | Internal business information, non-critical applications |
| High | Large impact | Core business systems, medical or financial records, personnel data |
Scales in use¶
Three levels are the simplest. Some organisations use a finer scale per aspect, for example 0 to 3, where 0 is public
or no impact and 3 is the highest level. Use the scale of your organisation and apply it to all three aspects. The
meaning of each level, in your own words, belongs in your classification policy.
Recovery objectives¶
Classification also feeds the targets for recovery. Agree these with the business and record them for the workload:
| Term | Meaning |
|---|---|
| RPO (recovery point objective) | The point to which data must be restored for the activity to continue. In practice: how much data loss is acceptable. |
| RTO (recovery time objective) | The time after a disruption in which the activity or service must be recovered or resumed |
| MTPD (maximum tolerable period of disruption) | The longest time an activity can be disrupted before the impact becomes unacceptable |
The RTO must fit inside the MTPD. Use them to choose backup frequency, redundancy and failover tests (Operate your workload).
Where you record the classification¶
Record the classification on the workload so it is visible and can drive controls. Some platforms use tags for the three aspects, the recovery objectives, the business criticality and a service class that links the workload to a support level (Extended tag set). The classification can also drive access controls: for example a stricter conditional access policy for access to production data of a higher level (Developer access with point-to-site VPN).
How it relates to the platform¶
- The platform baseline (private endpoints, encryption, central logging, policies, network segmentation, Entra ID RBAC) is meant to be enough for Low and often for Moderate workloads.
- High typically needs extra measures per service, for example customer-managed keys, higher redundancy, more strict network rules, extra logging or tests. These are your decisions and your work, with advice from the platform team.
- Classification also drives the
piitag, the choice of environment for production data (prdonly) and the management group (corp or online).
See Operate your workload for resilience, encryption and backup choices, and Onboarding for where the classification is requested.
Reference
Some customer platforms keep a detailed table of controls per Azure service and level (Low, Moderate, High). Such a table is customer-specific and not part of the MCP product. Ask your security officer for your organisation's equivalent. External references: NIST SP 800-60, ISO 27001, NEN 7510 (Dutch healthcare), GDPR/AVG, NIS2.