Information Asset Name Click here to enter text	Name of Completer Click here to enter text
Name of Business Area Click here to enter text	Type of Asset ☐ New Unclassified ☐ Reclassification
Name of Business Area Information Owner Click here to enter text	Date (YYYY-MM-DD)	Classification Level Choose a Level	Classification Label Choose a Label

Instructions:

Under the Information Security Classification (ISC) heading, identify the Classification Level (High, Med, or Low) that would best apply to the asset you are classifying, based on the information examples provided under Pursuant to FOIPPA column. Please refer to the Security Classification Framework for more information.

Once information is classified, next apply one of the 6 classification labels (High Sensitivity, Cabinet Confidential), (Med Sensitivity, Personal), (Low Sensitivity, Public) listed under ISC Classification Labels. For example: if Cabinet Document under High is selected then the label is classified as High and labeled Cabinet Confidential.

If a STRA has been completed, check off “STRA Performed” and fill in the Risk Scorecard number (RS#). If not known, refer to iSMART for the number. Proceed to fill in the security controls that apply to the asset.

After identifying the proper security classification level and label, enter this information into 1) the header portion of the form above; 2) into APMS.

Fill in Section 2 if relevant, to classify the Application’s Outputs. Please note: labeling of application outputs should be consistent with the application labeling. Only exceptions should be documented in Section 2.

Section 1 – Application Asset

Information Security Classification (ISC)	Pursuant to FOIPPA	STRA Performed ☐ iSMART RS# (e.g. RSXXXX) Click here to enter text Please select the following security controls
Classification Levels	Classification Labels	Could reasonably be expected to cause; extremely serious personal or enterprise injury, significant financial or tangible asset loss, public safety or loss of life; social hardship and major political or economic impact. Examples of Information that contain: ☐ Witness records ☐ Personal Medical Records ☐ Child Abuse ☐ Justice Sector confidential information (e.g. law enforcement, court information, witness protection programs) ☐ Evidentiary information for Prosecution ☐ Provincial Budget prior to public release ☐ Cabinet Documents ☐ Other Specify: Click here to enter text	☐ Confidentiality	☐ Disclosed to named individual or position only
HIGH	High Sensitivity Cabinet Confidential
☐ Integrity	☐ Requires 100% verification of code
☐ Availability	☐ No Interruption – available during regular business hours ☐ Access List
Nature of Harm	☐ Financial loss ☐ Degraded performance ☐ Loss of mgmt. control ☐ Damaged reputation ☐ Impaired growth ☐ Health & Safety ☐ Environmental impact
MEDIUM	Medium Sensitivity Personal* *Personal label is used for information that identifies a person and its disclosure may cause serious harm to the person. When the “personal” information is combined with higher sensitive info, it should be classified as “High”	Could reasonably be expected to cause serious personal or enterprise injury, loss of competitive advantage, loss of confidence in government program, moderate financial loss or penalty and damage to partnerships, relationships and reputation. Examples of Information that contain: ☐ Law Enforcement Advice ☐ Economic Interests of BC ☐ Provincial Standardized Tests for schools ☐ Personal information in briefing/policy notes ☐ Personal Information in files or records ☐ Personal case files ☐ Other Specify: Click here to enter text	☐ Confidentiality	☐ Disclosed to specific group
☐ Integrity	☐ Requires 100% integrity check
☐ Availability	☐ No Interruption beyond 1 business day
Nature of Harm	☐ Financial loss ☐ Degraded performance ☐ Loss of mgmt. control ☐ Damaged reputation ☐ Impaired growth ☐ Health & Safety ☐ Environmental impact
LOW	Low Sensitivity Public	Could reasonably be expected to cause injury to persons or enterprises that would result in minor financial loss, embarrassment and inconvenience. Examples of Information that contain: ☐ Staff meetings ☐ Escalation procedures ☐ Communications to claims clerk ☐ Telephone directory ☐ Other Specify: Click here to enter text	☐ Confidentiality	☐ Disclosed to Other Public Sector or Non-employees
☐ Integrity	☐ Requires 100% integrity check
☐ Availability	☐ No interruption beyond 3 business days
Nature of Harm	☐ Financial loss ☐ Degraded performance ☐ Loss of mgmt. control ☐ Damaged reputation ☐ Impaired growth ☐ Health & Safety ☐ Environmental impact

Section 2 – Application Outputs (Complete this section if classification level is different than Section 1 - Application Asset)
Type of Information Asset (i.e. report, spreadsheet) Click here to enter text	Classification Level Choose a Level	Classification Label Choose a Label
Name of Information Asset Click here to enter text
Safeguarding Information
Type of Media Information Resides On ☐ Paper ☐ Portable Storage Device ☐ Network drive (LAN) ☐ Other specify: Click here to enter text Media Labeled ☐ Yes ☐ No Related Material Labeled (Material used in preparing briefing notes, drafts, and photocopies) ☐ Yes ☐ No
Distribution of Media ☐ Recipient advised of Disclaimer ☐ Copies numbered ☐ Watermarked - “Not for copying without written consent of information owner” ☐ Named individual/position
Storage of Physical Media (Check all that apply within level) ☐ Paper ☐ Portable Storage Device ☐ Other specify: Click here to enter text ☐ No Physical outputs exist
High ☐ Fire resistant container ☐ Locked Container ☐ Access by authorized employee ☐ Signed out ☐ Desktop cleared in absence ☐ Drawers, cabinets containing sensitive information locked	Medium ☐ Locked Container ☐ Access by authorized employee ☐ Signed out ☐ Desktop cleared in absence ☐ Drawers, cabinets containing sensitive information locked	Low ☐ Desktop cleared in absence ☐ Drawers, cabinets containing sensitive information locked
Data Transmitted by Application
Facsimiles (Check all that apply within level)
High ☐ Strictly Prohibited	Medium ☐ Supervised fax machine ☐ Authorized employee supervision sending & receiving ☐ Call confirm fax number ☐ Fax cover prepared ☐ Fax located in a secure area ☐ Transmission acknowledged by sender & receiver	Low ☐ Supervised fax machine ☐ Authorized employee supervision sending & receiving ☐ Call confirm fax number ☐ Fax cover prepared ☐ Fax located in a secure area ☐ Transmission acknowledged by sender & receiver
E-mail & Electronic Data Interchange (Check all that apply within level)
High ☐ Mandatory file encryption between sender & receiver ☐ Maintain transmission record ☐ Not forwarded to Internet account (gmail, hotmail, cloud) ☐ Digital signature used	Medium ☐ Encryption preferred ☐ Maintain transmission record ☐ Not forwarded to Internet account (gmail, hotmail, cloud) ☐ Digital signature used	Low ☐ Attached files password protected ☐ Maintain transmission record ☐ Not forwarded to Internet account (gmail, hotmail, cloud)

Security Threat and Risk Assessment (STRA)

Freedom of Information and Protection of Privacy Act (FOIPPA)