Tallgrass Precision ComponentsDocument Assistant
View as
Library / IT-05

IT-05 Data Classification and Handling

IT-05 Data Classification and Handling

Revision 2 · Effective 2025-09-08

1 Purpose

This standard defines the four classification levels for Tallgrass information and the handling rules for each level, so that customer technical data, export-controlled data and personal data are protected in proportion to the harm their disclosure would cause.

2 Scope

This standard applies to all company data in any form (electronic files, email, Teams messages, ERP records and paper) handled by employees and contractors.

3 Definitions

  • Sensitivity label: a Microsoft Purview label applied to a file or email that marks it and enforces protection.
  • Data owner: the manager accountable for a set of data (see IT-04).
  • Classification levels: Public, Internal, Confidential and Restricted, from least to most sensitive.

4 Responsibilities

  • Everyone classifies the data they create, applies the correct label, and follows the handling rules in section 5.
  • Data owners decide the classification of data in their area when it is unclear.
  • IT configures Purview labels and protection and answers questions at ext. 2210.
  • The Contracts & Export Compliance Manager decides whether technical data is export-controlled (EXP-01).

5 Classification levels and handling

5.1 Public

Information approved for release outside the company. Examples: the website, product capability brochures, published AS9100D and ISO 9001:2015 certificates, job postings.

  • Storage: any company location.
  • External sharing: allowed.
  • Label: "Public".
  • Encryption: not required.

5.2 Internal

The default level for business information that is not meant for outsiders but would cause limited harm if disclosed. Examples: procedures and work instructions, organization charts, production schedules, internal announcements, training material.

  • Storage: Microsoft 365 only (OneDrive, SharePoint, Teams) or company business systems, per IT-01.
  • External sharing: only with a business need, using SharePoint links to specific people; "Anyone" links are not allowed.
  • Label: "Internal". This is the default label applied automatically to new documents and email; unlabeled data is treated as Internal.
  • Encryption: company devices are encrypted with BitLocker; no extra file encryption is required.

5.3 Confidential

Information whose disclosure would harm Tallgrass, a customer or a supplier. Examples: customer drawings, models and specifications that are not export-controlled, quotes and pricing, contracts, NC programs, supplier pricing, quality records containing customer data, financial results.

  • Storage: department SharePoint sites limited to people with a need to know, the ERP, or the DNC server. Not on personal devices except inside the protected Outlook and Teams apps (IT-01).
  • External sharing: only with a customer or supplier under contract or NDA, using SharePoint links to specific people that expire after 30 days. Emailed attachments to external parties must be sent with Outlook "Encrypt".
  • Label: "Confidential", which adds a header and footer marking and blocks "Anyone" links.
  • Encryption: encrypted in transit when sent externally; never copied to removable media except an IT-issued encrypted USB drive.
  • AI: may be used only with Microsoft 365 Copilot signed in with a Tallgrass account; never pasted into any other AI tool.

5.4 Restricted

Information whose disclosure could break the law, breach a government contract or seriously harm individuals. Restricted covers export-controlled technical data (ITAR and EAR), Controlled Unclassified Information (CUI), HR personal data (for example Social Security numbers, medical and I-9 information, personnel files) and pay data.

  • Storage: ITAR and other export-controlled data only in the restricted "ITAR Programs" SharePoint site and ERP jobs flagged "ITAR", handled per EXP-01. HR personal data and pay data only on the HR SharePoint site and in HR and payroll systems, handled per HR-230 and HR-220.
  • External sharing: export-controlled data only after review by the Empowered Official under EXP-01; HR and pay data only as permitted by HR rules. Never to personal email.
  • Label: "Restricted", which encrypts the content, limits opening to authorized Tallgrass accounts, and blocks forwarding, printing to PDF and external sharing.
  • Encryption: always encrypted at rest and in transit by the label. Restricted content cannot be opened on personal phones.
  • AI: export-controlled data must not be entered into any AI tool, including Copilot (EXP-01). Other Restricted data must never be pasted into any AI tool other than Microsoft 365 Copilot signed in with a Tallgrass account.

5.5 Labels and changes

Choose the label from the Sensitivity menu in Office or Outlook. A document takes the classification of the most sensitive information it contains. Lowering a label requires a typed justification, which is logged. If you are unsure, apply the higher level and ask the data owner.

5.6 Paper and disposal

Printed Confidential and Restricted documents are collected from the printer immediately, kept in a locked drawer when unattended, and disposed of in the locked shred bins. Old drives and removable media are returned to IT for destruction.

5.7 Mishandling

Confidential or Restricted data sent to the wrong person, stored in the wrong place, or exposed in any other way is reported immediately as a security incident under IT-06. Suspected export violations are also reported to the Empowered Official immediately (EXP-01).

6 Records

Label activity and label downgrade justifications are kept in Microsoft Purview audit logs.

7 Revision history

Rev Date Change Approved by
1 2023-05-15 First issue. Sam Kettering
2 2025-09-08 Introduced Microsoft Purview sensitivity labels with Internal as default label; added AI rules per level; added CUI to Restricted. Sam Kettering