A Note on Data Classification

Cornell currently follows a three-tier data classification standard based on inherent risk as noted in Policy 5.10, which includes “High-Risk”, “Moderate-Risk and “Low-Risk”. This document introduces a four-tier inherent-risk categorization to lend clarity to the “Moderate Risk” data classification, which is a spectrum of highly sensitive data (that is not High Risk) to somewhat innocuous data that should not be made public and may be regulated. 

The fourth tier, “Moderate-High Risk”, data denotes data that has a generally high sensitivity, that requires additional consideration for security and privacy.

Terminology

Classification labels: A categorical designation applied to data, such as “Confidential”, “Restricted”, “Internal” or “Public”, that describes the data’s handling or protection status. Some institutions use “Level 0”, “Level 1”, “Level 2”, “Level 3” as classification labels. Cornell uses “High Risk”, “Moderate Risk” and “Low Risk”.

Inherent risk: The level of potential harm from unauthorized disclosure, loss, or misuse of the data, expressed as High, Moderate-High, Moderate, or Low Risk.

Personally identifiable information (PII): Any data that can be used, alone or combined with other information, to identify, contact, or locate a specific individual. Broadly, within Human Subject Research and other regulated contexts (for more precise definitions refer to policies and regulations provided for your regulated use of PII):

• Identified data: Information that directly names or explicitly links to a specific individual, such as a name, Social Security number, or email address.
• Deidentified data (that is identifiable): Information from which direct identifiers have been removed or replaced with codes or pseudonyms, but which can still be linked back to an individual through a key or by combining it with other available data.
• Anonymous data: Information that has been irreversibly stripped of any link to an individual so that no one, including the data holder, can reasonably re-identify the person it came from.

System of Record: The authoritative source for a particular set of data, meaning the one system designated as holding the official, definitive version of that information. When the same data appears in other systems, the system of record is the one that is trusted if there is a discrepancy, and the one where updates should originate. (e.g. PeopleSoft, Workday, Kuali, etc). An Adjacent Supporting IT System is not itself a system of record or a production system for a given service, but one that connects to, depends on, or supports one. (e.g. ImageNow, data warehouse, etc.)

Regulated Data: Information subject to legal, regulatory, or contractual protections, which may span High Risk, Moderate-High Risk, and Moderate Risk depending on the applicable requirements and potential harm.

Sensitive Data: A broad term that covers data that is not publicly available and requires protection by law or policy. Broadly covers all non-public information whose unauthorized disclosure, loss, or misuse could cause harm depending on inherent risk.

How to Handle Data by Risk Type

This table illustrates the considerations you need to take when using data at different risk levels. This document establishes a baseline and specific requirement in regulations need to be also considered to be fully compliant.  The words “severe”, “significant”, “moderate”, and "negligible" are defined in later sections of this document.

• High Risk

  Sensitivity Description	Information that carries the risk of severe harm to individuals or the university, and/or is protected by federal or state regulations.
  Data Stewardship Approval	Data Steward approval required for collection, storage, processing, and transmission.
  Data Distribution Characteristics	Minimal distribution as approved by the Data Stewards Highly restricted; generally must remain in systems of record (e.g., Human Resources System, Financial Management System, Student Information System) and supporting systems approved by the CIO.
  Physical Data Security	Access to paper, analog media or digital storage records highly restricted. Access to digital storage/servers highly restricted and monitored Physical destruction requires certification if handled by third party
  Data Security	Highest rigor of cybersecurity and privacy controls; approved by the CISO. In-depth Technical Risk Assessment and Privacy Review required for 3rd parties. REQUIRED Best Practices Include: Central Management Monthly Access Control Reviews Encryption in transit Encryption at rest Multi-factor authentication Bi-directional default deny firewalls Data loss prevention Shortened Session timeouts Computer compliance checks Anti-malware 7-day vulnerability remediation Immutable backups Follow data retention policies Access logging Secure digital destruction
  Data Storage Limitations	Prohibited outside approved systems of record. Prohibited on desktop and mobile computers. Prohibited on email.
  AI Processing Considerations	May be processed within the system of record only. Vendor contract must prohibit use of data for training, and must address data retention. All AI sub processors must be accounted. AI tools cannot be used in clinical settings, telemedicine interactions, or patient encounters, unless exception is received

• Moderate-High Risk

  Sensitivity Description	Information that carries the risk of significant harm to individuals or the university and/or may be protected by federal or state regulations.
  Data Stewardship Approval	Data Steward approval required for collection, storage, processing, and transmission.
  Data Distribution Characteristics	Limited distribution as approved by the Data Stewards Restricted access; may be processed in systems outside of record that are approved by the CIO, such as a data warehouse.
  Physical Data Security	Access to paper, analog media or digital storage records highly restricted. Access to digital storage/servers highly restricted and monitored Physical destruction requires certification if handled by third party
  Data Security	Very high rigor of cybersecurity and privacy controls; approved by the CISO. In-depth Technical Risk Assessment and Privacy Review required for 3rd parties. REQUIRED Best Practices Include: Central Management Quarterly Access Control Reviews Encryption in transit Encryption at rest Multi-factor authentication Bi-directional default deny firewalls Computer compliance checks Anti-malware 7-day vulnerability remediation Immutable backups Follow data retention policies Access logging Secure digital destruction RECOMMENDED Best Practices Include: Data loss prevention Shortened Session timeouts
  Data Storage Limitations	Prohibited outside approved systems of record or adjacent secure production systems Prohibited on desktop and mobile computers. Prohibited on email.
  AI Processing Considerations	May be processed within the system of record, or adjacent secure production systems. Vendor contract must prohibit use of data for training and must address data retention. All AI sub processors must be accounted. AI tools may be used in clinical settings, telemedicine interactions, or patient encounters with approval.

• Moderate Risk

  Sensitivity Description	Information used for business purposes, which might carry the risk of moderate harm to individuals or the university.
  Data Stewardship Approval	Data Steward approval depends on risks.
  Data Distribution Characteristics	Distribution flexible within Cornell as approved by the Data Stewards Governed by need-to-know consistent with least-privilege principles.
  Physical Data Security	Access to paper or analog media records restricted according to risk. Access to digital storage/servers monitored
  Data Security	Moderate cybersecurity and privacy controls; reviewed by the CISO. Technical Risk Assessment and Privacy Review for 3rd parties depends on risk. REQUIRED Best Practices Include: Annual Access Control Reviews Encryption in transit Encryption at rest Multi-factor authentication Anti-malware 14-day vulnerability remediation Follow data retention policies RECOMMENDED Best Practices Include: Central Management Bi-directional default deny firewalls Data loss prevention Shortened Session timeouts Computer compliance checks Immutable backups Access logging Secure digital destruction
  Data Storage Limitations	Permitted on desktop computers. Permitted on email.
  AI Processing Considerations	May be processed outside the system of record. Vendor contract should prohibit use of data for training, as appropriate for the business need. AI tools may be used in clinical settings, telemedicine interactions, or patient encounters.

• Low Risk

  Sensitivity Description	Public or openly-shared information, which carries the risk of negligible harm to individuals or the university.
  Data Stewardship Approval	Data Steward approval not required.
  Data Distribution Characteristics	No restrictions on distribution.
  Physical Data Security	Access to paper records not restricted. Minimal restrictions to digital storage/servers Standard paper or electronic disposal
  Data Security	Minimum cybersecurity and privacy controls; monitored by the CISO. REQUIRED Best Practices Include: Anti-malware 14-day vulnerability remediation RECOMMENDED Best Practices Include: Central Management Annual Access Control Review for Content Maintenance Encryption in transit Encryption at rest Multi-factor authentication Bi-directional default deny firewalls Data loss prevention Shortened Session timeouts Computer compliance checks Immutable backups Access logging Secure digital destruction
  Data Storage Limitations	No restrictions.
  AI Processing Considerations	No restrictions.

Risk Levels of Different Kinds of Data

This table provides a non-comprehensive list of data types that are categorized by inherent risk.

• High Risk

  Personal & Identity Data	Social Security numbers Driver's license numbers Passport or visa numbers Biometric data Usernames and passwords Human Genetic data Data collected from/about minors Birthdates (combined with identity data)
  Employee / Personnel Data	Insurance information (HIPAA) Dependent information Occupational Health Information Background checks for employees
  Education Data	Title IX information Disciplinary records
  Financial Data	Regulated financial data: Credit/debit card numbers. Bank account numbers. Personal financial information covered under GLBA.
  Health & Medical Data	Protected health information (PHI), including health records and patient treatment information (HIPAA). Human genomic or genetic data. Protected HIPAA data sets.
  Research Data	Federally Classified Data Limited data sets (NIH, HIPAA, etc) Human genomic or genetic data IRB Governed More Than Minimal Risk identifiable human subjects research data (IRB governed)
  Institutional / Organizational Data	User Accounts or System Passwords Health and safety impacting infrastructure data (building plans, networks, utilities, etc.) Physical security-related information covered under various law-enforcement regulations like CJIS Federal Select Agent Program data Radiation Safety data

• Moderate-High Risk

  Personal & Identity Data	International Personal Data (login required) Protected characteristics under data protection regulations: Race, ethnicity, national origin Citizenship/immigration status; Trade union membership; Geolocation information; Philosophical, Religious, or political beliefs; Sexual orientation or sex life information
  Employee / Personnel Data	Performance reviews Disciplinary actions Payroll/Salary information Benefits selections Employment records Non-public directory biographical data
  Education Data	Non-directory FERPA-protected data including: Enrollment records Financial aid applications Advising session records Grades Disability accommodation records Instructors class lists Student exams or papers
  Financial Data	Donor information Financial records that includes sensitive information Investment information Loan records Tax records of the university, its employees, parents, and students
  Health & Medical Data	Medical or health insurance information (non-HIPAA)
  Research Data	Unpublished regulated research data IRB Governed Less Than Minimal Risk Identifiable Human Subjects research data (de-identified data with keys available or identity discernable in data that may cause minimal but reportable harm) De-identified research health data (Non-HIPAA) Protected research data.
  Institutional / Organizational Data	Infrastructure data (building plans, networks, utilities, etc.). Emergency planning information Business-related data. Security-related information. Library circulation records Video surveillance

• Moderate Risk

  Personal & Identity Data	General personal details (name, personal phone, personal email) Travel arrangements
  Employee / Personnel Data	Basic employee directory data not otherwise publicly available (Cornell email, work phone, office location) Letters of recommendation
  Education Data	Student ID Student course schedules Emails or records maintained by anyone about a student other than High Risk or Moderate-High risk. FERPA directory information. Letters of recommendation
  Financial Data	Aggregated financial data (e.g., budgets, reports). Budget information
  Health & Medical Data	Not applicable.
  Research Data	Unpublished Intellectual property Anonymized human subjects research data Peer review content. Grant information
  Institutional / Organizational Data	Cornell ID card numbers Travel arrangements Vehicle registration Voicemail/Email

• Low Risk

  Personal & Identity Data	Information publicly visible in Cornell web search (no login required). Public data sets.
  Employee / Personnel Data	Information publicly visible in Cornell web search (no login required); may include Cornell email, work phone, or office location if published on a departmental or public web page. Public data sets.
  Education Data	Information publicly visible in Cornell web search (no login required). Public data sets.
  Financial Data	Information publicly visible in Cornell web search (no login required). Public data sets.
  Health & Medical Data	Information publicly visible in Cornell web search (no login required). Public data sets.
  Research Data	Publicly available research data sets Unrestricted research data
  Institutional / Organizational Data	Information publicly visible in Cornell web search (no login required). Public data sets.

Harm Level Definitions 

The definitions below describe the level of harm associated with unauthorized disclosure, loss, or misuse of data, and map to Cornell's four-tier data classification framework (High Risk, Moderate-High Risk, Moderate Risk, Low Risk). Each classification tier corresponds to the harm level a data element's exposure would most plausibly cause. 

Considerations: 

• Aggregation effect: combining otherwise lower-risk data elements (e.g., name + birthdate + geolocation) can elevate the overall harm level even when no single element is independently Severe or Significant. Classify the combined data set, not just its individual fields. 
• Where a data set could plausibly cause harm across more than one dimension, classify to the highest applicable harm level across all dimensions (the framework is not additive across rows). 
• Physical Harm is assessed independently of financial or reputational impact — a data element with low financial exposure (e.g., a home address) may still warrant a higher classification if disclosure creates a credible safety risk for a specific individual.

Harm Dimension

• Severe

  Maps to Risk Tier	High Risk
  Legal / Regulatory	Triggers mandatory breach notification, regulatory fines, litigation, or loss of ability to operate a program (e.g., HIPAA, GLBA, export control, CJIS, SSN exposure).
  Financial	Losses at a significant institutional scale (breach response, legal fees, fines, remediation); potentially seven figures or loss of federal funding/contracts.
  Reputational	National media coverage; lasting damage to institutional trust; loss of accreditation or research partnerships.
  Operational	Extended disruption to critical university systems or research; loss of ability to conduct core functions.
  Individual Impact	Identity theft, financial fraud, discrimination, or other irreversible harm to a person (student, employee, research subject, or patient).
  Physical Harm	Exposure creates a credible risk of death, serious bodily injury, or physical danger to an individual (e.g., location/geolocation data enabling stalking, disclosure that endangers survivors of violence or at-risk individuals, safety-critical research or infrastructure data).

• Significant

  Maps to Risk Tier	Moderate-High Risk
  Legal / Regulatory	Likely regulatory scrutiny or contractual violation; possible legal exposure, though not automatically triggering breach notification.
  Financial	Substantial but bounded cost — incident response, contract penalties, regulatory fines/penalties or loss of a specific funding source.
  Reputational	Local or regional media attention; measurable erosion of trust with a specific community (a school, department, or partner institution).
  Operational	Meaningful disruption to a department or system, recoverable within a defined period.
  Individual Impact	Embarrassment, targeted harassment risk, or moderate financial/privacy harm to an individual, but not identity-theft-level exposure.
  Physical Harm	Exposure creates a plausible but lower-probability risk of physical harm or safety concern (e.g., data that could facilitate harassment or unwanted in-person contact).

• Moderate

  Maps to Risk Tier	Moderate Risk
  Legal / Regulatory	Minor policy or contractual noncompliance; unlikely to trigger external reporting obligations.
  Financial	Limited cost, mostly internal remediation time and effort.
  Reputational	Internal or limited external awareness; unlikely to reach media.
  Operational	Inconvenience or delay to normal business processes; workaround available.
  Individual Impact	Minor inconvenience or privacy concern (e.g., unwanted contact) with low likelihood of lasting harm.
  Physical Harm	Minimal, indirect potential for physical harm; would require substantial additional information or effort to translate into a safety risk.

• Negligible

  Maps to Risk Tier	Low Risk
  Legal / Regulatory	No compliance obligations triggered; data is intended for or already in public circulation.
  Financial	No meaningful cost.
  Reputational	No expected impact.
  Operational	No disruption.
  Individual Impact	None — data is already public or non-identifying (e.g., public web search results, open datasets).
  Physical Harm	No plausible link to physical harm or safety risk.