Understanding Sensitivity Labels

To further align our organization with the best practices in regard to data governance we have recently began onboarding Microsoft Purview which allows for data classifcation and the application of data sensitivity labels. 

It is very important to utilize the availalbe sensitivity labels to classify and to protect your data and any resources you utilize. 

What purpose do Sensitivity labels serve?

Sensitivity labels help with classifying and protecting emails, documents, Sharepoint and teams sites that may contain sensitive information. These help to protect against accidental oversharing or providing information to parties where it is not required. 

What Sensitivity labels are available?

Currently, we have 6  label types that can be applied to many of the resources we utilize including email, Sharepoint, teams, and meetings.

Public

Internal

          Internal - Confidential

          Internal - Restricted

Confidential

Restricted

What are the differences in the availble Sensitivity labels?

Public - This label should be used for both internal and external resources and communication that doesn't contain any confidential organizational information, PII, or sensitive information. 

Internal - This label should only be used for internal resources and communications between people that are employed by New River CTC.  Won't allow external sharing to anyone that is not an employee of NRCTC

Internal - Confidential - This label should only be used for internal resources and communications that contains confidential information with NO PII. Provides encryption with no forwarding restrictions when used with email. Files can be downloaded by the recipient and any information can be copied, put in a screenshot or otherwise sent to other people. Once opened in a program there will be a banner added that states the content is restricted. between people that are employed by New River CTC. Won't allow external sharing to anyone that is not an employee of NRCTC

Internal - Restricted - This label should only be used for internal resources and communications that contains confidential information AND/OR PII. Provides encryption and won't allow forwarding when used with email. Files can be downloaded by the recipient, and any information contained can't be copied, put into a screenshot, attempts to directly forward the information will fail, and if the file is sent on a separate email to another person they won't be able to open the document.  Once opened in a program there will be a banner added that states the content is restricted. between people that are employed by New River CTC. Won't allow external sharing to anyone that is not an employee of NRCTC

Confidential - This label should be used for both internal and external resources and communication that contains confidential information with NO PII. Provides encryption with no forwarding restrictions when used with email. Files can be downloaded by the recipient and any information can be copied, put in a screenshot or otherwise sent to other people. Once opened in a program there will be a banner added that states the content is restricted. 

Restricted - This label should be used for both internal and external resources and communication that contains confidential information AND/OR PII. Provides encryption and won't allow forwarding when used with email. Files can be downloaded by the recipient, and any information contained can't be copied, put into a screenshot, attempts to directly forward the information will fail, and if the file is sent on a separate email to another person they won't be able to open the document.  Once opened in a program there will be a banner added that states the content is restricted. 

Current impacts of labels to other resources

Labels applied to meetings, sharepoint sites, and teams sites can also apply other restrictions like ability to invite guests and external sharing with people not in our organization. While most labels don't restrict the invitation of guests and external sharing of information the internal label will not allow for external sharing or adding people that are not employed by NRCTC.