Nevada unveils policy for consistent statewide data classification

Source Domain: statescoop.com

Nevada’s technology department on Wednesday announced a new policy aimed at uniformly classifying its data, a once arcane practice gaining celebrity in an age of AI and cyberattacks.

Officials said the new “proactive” policy replaces inconsistent practices used across state agencies to categorize the sensitivity of various data, ranging from innocuous meeting notes to cybersecurity defense plans. Officials hope, a press release said, the standard will “eliminate the need for separate, bespoke data-sharing agreements” and encourage more cross-agency work. But the chief motivation is keeping data secure: According to a video published by the Governor’s Technology Office, the absence of proper data classification could risk residents’ personal information being “handled with the same low level of security of, say, a press release.”

A spokesperson from the technology department said the new policy was developed over the course of a year, by a group led by the state’s chief data officer, Jason Benshoof. It contains four tiers of data sensitivity and an option for agencies to add subtiers. Information meant to be public, like meeting agendas, is “public,” internal communications and draft documents are “sensitive,” Social Security numbers and financial information are “confidential” and things like encryption keys or criminal history records are “restricted.” (According to the press release, the new policy does not affect what are considered public records, and that “classification tiers are for internal safeguarding and handling.”)

Nevada incurred a ransomware attack last May after a state employee unknowingly downloaded malware from a spoofed website. Michael Hanna-Butros Meyering, the technology bureau’s communications chief, said that attack wasn’t helpful, “by any means, but it sure clarified the urgency” of the data classification project that Benshoof had begun leading several months earlier….

Source