EVIDENCE TEMPLATE UC-14
Data Classification Policy
Define how your organization identifies, labels, stores, and protects sensitive data. Carriers require knowledge of what data you handle and active controls to prevent unauthorized access and exfiltration.
What this cyber insurance requirement is
A data classification policy for cyber insurance should define a taxonomy with classification levels (Public, Internal, Confidential, Restricted), inventory data types your organization handles (PII, financial data, health/PHI, IP), specify storage locations (cloud, on-premises, employee devices), document DLP (Data Loss Prevention) controls in place, and define retention and disposal procedures. Carriers require this evidence to understand your data risk profile and confirm you have visibility and controls over sensitive information.
Create your data classification policy below
What you'll get
- Classification taxonomy (Public, Internal, Confidential, Restricted)
- Data types inventory (PII, financial, health, IP, employee, vendor data, payment cards)
- Storage locations and approved platforms
- DLP controls (Microsoft Purview, Google Cloud, Symantec, etc.)
- Handling and protection requirements by classification level
- Data retention and disposal procedures
- Employee training and awareness requirements
- Carrier alignment (Hartford, Coalition, Beazley, Travelers)
What carriers are looking for
Each carrier asks slightly different questions. Here are some named artifacts by carrier.
Hartford
- Types of sensitive data handled and processed
- Sensitive data classification methods
- Handling and protection approaches
Coalition
- Sensitive data types and volume handled
- Storage locations and systems
- Controls to prevent unauthorized access
Beazley
- Data types processed and stored
- Classification methodology and taxonomy
- Data security controls approach
Travelers
- Existence of data classification system
- Employee training on data handling procedures
- Data retention and disposal policies
What to collect
Evidence artifacts your broker will need during the renewal process.
📋
Approved policy document
Signed-off classification policy with taxonomy, data types, and handling rules by classification level.
📊
Data inventory & mapping
Documentation of systems storing sensitive data and their classification level.
⚙️
DLP configuration screenshots
Evidence showing DLP rules and policies configured in your chosen platform.
👥
Employee training records
Attendance and completion records for data classification and handling training.
📅
Retention & disposal schedules
Documented procedures for data retention periods and secure disposal methods.
📝
DLP incident logs
Sample logs showing detection and response to data exfiltration attempts.
Important: What this doesn't prove
Be upfront about these gaps. Carriers appreciate honesty over overstatement.
Correct data classification:Policy doesn't prove all data is actually classified correctly in systems.
DLP effectiveness:Configuration doesn't prove DLP actually blocked all exfiltration attempts.
Complete data inventory: You may have unidentified data stores or shadow IT systems.
Employee compliance:Training records don't prove employees follow data handling procedures.
Authorized-only access:DLP doesn't prevent authorized users from exfiltrating sensitive data.
Who owns what
🏢Insured/Business Owner
Approves policy, identifies data types handled, ensures adoption across business units, owns governance.
🔧MSP/IT Security
Implements policy, deploys DLP tools, maintains data inventory, administers training, collects evidence.
🤝Broker
Interprets carrier requirements, packages submissions, verifies implementation, flags gaps for remediation.
Frequently Asked Questions
What is data classification and why does it matter for cyber insurance?
Data classification organizes information into categories (Public, Internal, Confidential, Restricted) based on sensitivity and business impact. Carriers want to confirm you understand what sensitive data you hold and have protection measures in place.
What data types do cyber carriers care about most?
Customer PII, financial data, health data (PHI), employee data, intellectual property, and payment card data. If you handle any of these, carriers expect documented controls.
Is DLP required?
Not mandatory, but expected if you handle large volumes of sensitive data. DLP tools (Microsoft Purview, Google Cloud DLP, Symantec) detect and block exfiltration attempts and demonstrate proactive controls.
Do we need separate handling rules for each classification level?
Yes. Restricted data should require encryption, access logging, and MFA. Confidential data requires encryption and restricted access. Internal data needs basic access controls. Carriers expect proportionate controls by sensitivity.
Who should classify data?
Data owners or stewards should classify data when it's created or obtained. They understand the sensitivity best. Automated tools can help, but human judgment is essential for accuracy.
We don't have a formal data inventory yet. What do we do?
Start with manual documentation of systems storing sensitive data. Create a spreadsheet with system name, data types, classification level, and owner. Then supplement with automated discovery tools (like Varonis or Cloudflare) to identify shadow data stores.
Sources (March 2026)
- Hartford – Data classification methods and sensitive data protection requirements
- Coalition – Data inventory and unauthorized access prevention controls
- Beazley – Data classification methodology and data security approach expectations
- Travelers – Data classification system, training, and retention policy requirements
- NIST Cybersecurity Framework – Information protection processes and procedures (PR.DS-1, PR.DS-2)
- ISO 27001 – Asset management and information classification requirements