Therefore a classification system is needed, whereby information is classified, a policy is laid down on how to handle information according to it's class and security mechanisms are enforced on systems handling information accordingly. In the coming sections, classes for information availability and sensitivity are proposed, requirements for systems based on these classes are proposed in chapter 5. Here a classification system is proposed which has four availability classes. It is based on the author's experience, as no equivalent standards are available for reference. To improve availability, preventative measures reduce the probability of downtime and recovery measures reduce the downtime after an incident.
All data has an owner.
The data or process owner must classify the information into one of the security levels- depending on legal obligations, costs, corporate into policy and business needs. If the owner is not sure at what level data should be classified, use level . The owner must declare who is allowed access to the data. All documents should be classified and the classification level should be written on at least the title page. Once the data on a system has been classified to one of the following levels, then that system should be installed to conform to all directives for that class and classes below.