Information Classification Framework

Purpose

This policy defines Carriyo's information classification scheme and the handling requirements for each classification level. It ensures that information assets are protected with controls appropriate to their sensitivity and criticality, and that all personnel understand their obligations when handling classified information.

Scope

This policy applies to all information created, received, processed, stored, or transmitted by Carriyo, regardless of format (digital, paper, verbal). It covers all employees, contractors, and third parties who handle Carriyo information.

Policy Statements

Classification Levels

Carriyo uses four classification levels. All information must be assigned one of the following classifications:

Public

• Definition: Information that is intended for public consumption or whose disclosure would cause no harm to Carriyo or its customers.
• Examples: Marketing materials, public website content, published blog posts, open-source code, public API documentation.
• Default Handling: No special controls required. May be freely shared externally.

Internal

• Definition: Information intended for use within Carriyo that is not sensitive but is not intended for public release.
• Examples: Internal meeting notes, non-sensitive project plans, internal process documentation, general company announcements.
• Default Handling: Accessible to all Carriyo employees. Should not be shared externally without a business reason.

Confidential

• Definition: Sensitive information whose unauthorized disclosure could cause significant harm to Carriyo, its customers, or its partners.
• Examples: Customer data (shipment data, order data, PII), financial records, employee personal data, proprietary source code, business strategies, contract terms, vendor agreements.
• Default Handling: Access restricted to personnel with a legitimate business need. Must be encrypted in transit and at rest. External sharing requires authorisation and appropriate protections (NDA, encryption, secure transfer).

Restricted

• Definition: Highly sensitive information whose unauthorized disclosure could cause severe harm and requires the strictest controls.
• Examples: Encryption keys, authentication credentials, API secrets, security configurations, penetration test reports, vulnerability assessments, incident response details.
• Default Handling: Access strictly limited to named individuals. Must be stored in approved secrets management or secure storage systems. Never transmitted via email or messaging. All access is logged and audited.

Classification Responsibilities

• Information Owners are responsible for classifying information assets they create or are responsible for.
• When classification is uncertain, the higher classification level must be applied until a determination is made.
• Customer data is classified as Confidential by default. Specific customer data may be elevated to Restricted based on contractual requirements or data sensitivity.
• All new information assets must be classified at the time of creation.

Labelling (A.5.13)

• Digital documents containing Confidential or Restricted information should be labelled with the classification level in the document header or metadata where practical.
• Email subject lines for messages containing Confidential or Restricted information should include the classification label (e.g., [CONFIDENTIAL]).
• Slack channels handling Confidential data should have the classification noted in the channel description.
• Physical documents (if any) must bear a visible classification label.

Handling Requirements by Classification

Reclassification

• Information may be reclassified when its sensitivity changes (e.g., a product feature becomes public after launch).
• Reclassification must be performed by the information owner and documented.
• Downgrading from Restricted requires CISO approval.

Roles and Responsibilities

Compliance and Enforcement

Compliance with this policy is assessed through periodic audits of information handling practices, access control reviews, and incident investigations. Mishandling of classified information is treated as a policy violation and addressed through the disciplinary process. Incidents involving unauthorized disclosure of Confidential or Restricted information are investigated as security incidents.