Data classification assigns information to categories based on confidentiality, allowing an AI team to apply different protections to different kinds of data. It exposes where sensitive inputs move through training, evaluation, and production, including flows that could reach unauthorized parties. section 11.1.1
Use classification to turn a security concern into concrete controls:
- Identify confidential data as it moves through the AI system. section 11.1.1
- Remove unnecessary sensitive data through data minimization or anonymize it before use. section 11.1.1
- Protect retained confidential data with end-to-end encryption and strict role-based access controls. section 11.1.1
- Support the classification policy with continuous monitoring, regular third-party audits, and team training. section 11.1.1
Recommendation feature breach risk
A rushed recommendation deployment leaves proprietary customer inputs insufficiently restricted. Mapping data flows reveals confidential information reaching unauthorized parties, prompting removal or anonymization, stronger access controls, encryption, monitoring, and audits. section 11.1.1
Figure 11.2 Data classification classifies data into multiple confidentiality levels for a differentiated security strategy.
Shows how multiple confidentiality levels support a differentiated security strategy. section 11.1.1
