Harbor Data / 01 / PRACTICE GUIDE
Data classification, ownership and lineage
Move from a file label to a data passport with business purpose, ownership, copies and handling conditions.
Download guide and workpapersOriginal AI-assisted SecNet educational content; examples are fictional. Not a source organization publication or endorsement. Sources checked: 2026-10-21.
EVIDENCE REVIEW DESK
Move from observations to decisions.
Code here is a local policy model with no target connection. Passing model cases are not security approval or device tests.
Label exists: who owns it? / Incomplete decision
Inspect an incomplete decision based on record existence or another positive signal. Consider denial cases alongside permitted use.
s => s.labelExists === trueA label establishes neither business ownership nor handling rules. Treating a labeled file as controlled without consequence and ownership review relies on incomplete evidence.
Choices and outputs last only on this open page; they do not update account progress, career status, points or certificates.
01 / EXPLANATION
Understand data in business context
Fictional Harbor holds contracts, customer summaries and product notices. Similar file formats do not imply equal sensitivity. A data owner identifies the business purpose, required fields, consequences of unauthorized disclosure and existing copies. A system administrator may operate storage without owning every business decision. Map the technical inventory to business accountability. This exercise contains synthetic metadata rather than personal records. Classification results do not automatically determine a person’s trustworthiness or an organization’s legal compliance; they support appropriate handling decisions.
02 / EXPLANATION
Connect labels to handling rules
Harbor’s teaching profile uses public, internal, confidential and restricted. These four names are not a universal standard or every product’s defaults. Define recipients, channels and controls for each label. Seeing a label on a file does not establish enforcement by the destination application. Review mislabeling and label loss during export too. Business owners and operators define exceptions and reclassification triggers. Learners decide from explicit handling rules rather than color alone. The local tool trusts declared labels and does not inspect content to confirm that classification.
03 / EXPLANATION
Lineage and copies
A customer table may produce reports, exports, test copies and backups. Recording these relationships helps scope permission changes, correction and disposal. A copy can have different controls in another environment. Removing the primary file does not remove every derivative. Harbor’s passport separates source, purpose, recipient and derivative ownership. Real discovery requires authorized source access; this package searches no network files. Unknown copies remain explicit gaps rather than being marked complete. A lineage drawing supports investigation but is not proof that every copy was found or that a downstream system applied a change.
04 / EXPLANATION
Changing data and changing controls
A new field, recipient or combined dataset can change sensitivity. Two individually low-risk fields can become identifying together. Trigger catalog review on these changes as well as a schedule. NIST SP 800-122 is a dated foundation for PII confidentiality, not a substitute for current law. A Harbor reclassification stays a record for owner review and applies no label to an actual file. The desired output is a versioned passport explaining purpose, owner, controls and copy boundaries, with uncertainty visible rather than hidden behind a completed catalog entry.
Build the evidence yourself.
Blank workpapers are not completed tests. Fill them in your authorized environment without secrets or real personal data.
Full guide with code, outputs and reasoning ↓Primary references
Explanations are authored by SecNet. References support method and platform context; verify current editions and organizational policy for real use.