Lesson 4 — Confidentiality vs Regulation & Role-Based Restrictions
The key distinction
Confidentiality is generally an internal need-to-know decision. Regulatory classification comes from external laws, treaties, industry standards, contracts, or similar obligations.
They aggregate differently.
Confidentiality
A data set normally takes one confidentiality level based on the most sensitive element.
The chapter’s example hierarchy runs from broadly available material through:
- General Audience
- Internal Use Only
- Confidential
- Restricted Confidential
- Registered Confidential
Registered Confidential represents the strongest example level in the chapter and involves signed legal responsibility for secrecy.
Regulation
A single data set may belong to several external categories at the same time. These categories are additive: every applicable required action remains in force.
So one report can have:
- one highest internal confidentiality level, plus
- multiple simultaneous regulatory/contractual categories.
Need-to-know vs allowed-to-know
- Need-to-know → internal confidentiality logic.
- Allowed-to-know → external regulatory/contractual logic.
Role-based access design
Role-based access reduces one-off individual permission assignments, but only if roles reflect real business need.
Role assignment grid — data first
Start from classifications/regulatory combinations and map which roles may perform which actions.
Role assignment hierarchy — people first
Start from users, workgroups, business units, or job families and inherit/restrict privileges through role relationships.
CRUD / CRUDE
Makes data actions explicit: Create, Read, Update, Delete, and sometimes Execute.
RACI is different
RACI maps Responsible, Accountable, Consulted, Informed for a process. It does not define data-operation permissions.
Recertify entitlements
A role can become inappropriate when someone changes jobs, an application adds a sensitive field, regulations change, or role inheritance expands. Review and revoke stale access.
Stop and check
Can one data set have one confidentiality level but three regulatory categories?
Yes. Highest internal confidentiality level + every applicable external category/action.
Source anchor: pp. 225–228 and role standards pp. 238–243.