Notifications
Clear all
Topic starter
21/08/2026 4:54 pm
TL;DR: Only 23% of organisations extensively use automation in data classification, according to Strac’s analysis of Ponemon data, and that leaves most policy programmes dependent on manual handling, inconsistent labels, and weak enforcement across SaaS and cloud. The control gap is not classification theory, it is operational lifecycle discipline.
NHIMG editorial — based on content published by Strac: A Detailed Guide on Data Classification Policy
By the numbers:
- Only 23% of organisations extensively utilise automation in data classification, while 77% use it to a lesser extent.
Questions worth separating out
Q: How should security teams classify data in cloud and SaaS environments?
A: Security teams should combine deterministic pattern matching with contextual methods that understand meaning, relationships, and business use.
Q: Why does data classification fail when organisations rely too much on manual tagging?
A: Manual tagging fails because data volumes, sharing patterns, and storage locations change faster than people can keep up.
Q: What do security teams get wrong about data lineage and access control?
A: They often treat both as separate documentation tasks instead of as evidence of control.
Practitioner guidance
- Define enforceable classification-to-control mappings Map each data class to specific controls such as encryption, access restrictions, retention, logging, and exception approval.
- Align classification with identity and access rules Tie sensitive data classes to role-based or attribute-based access decisions so users, contractors, and service accounts do not inherit broad default permissions.
- Use automation to detect and relabel drift Deploy automated discovery and classification for SaaS, cloud, and endpoint locations, then schedule periodic validation of detector accuracy.
What's in the full article
Strac's full article covers the operational detail this post intentionally leaves for the source:
- Policy templates and category examples for public, internal, confidential, and restricted data
- Operational handling guidance for storing, sharing, archiving, and disposing of data by classification level
- Automation and DLP feature detail for applying labels across SaaS, cloud, and endpoint workflows
- Role and responsibility examples for data owners, security teams, IT, employees, and third-party users
👉 Read Strac's guide to building a data classification policy →
Data classification policy and automation gaps: what teams miss?
Explore further
21/08/2026 5:11 pm
Shallow automation is the named failure mode here. The article shows that most classification programmes stall at policy definition and never mature into continuous enforcement. That creates a gap between declared sensitivity and actual handling, especially when data spreads across SaaS, cloud, and third-party workflows. The practical conclusion is that classification without enforcement is governance theatre.
A question worth separating out:
Q: How can organisations tell if classification is working well enough?
A: Classification is working only if it reliably identifies the assets that actually drive business, legal, or competitive risk, including unstructured documents and semantically sensitive material. If reviewers keep finding critical files marked as generic internal content, the control is producing false confidence rather than governance value.
👉 Read our full editorial: Data classification policy fails when automation stays shallow
