You can use rule-based sensitivity to assign a sensitivity level to document assets, such as PDF and Microsoft Word files, so you can govern unstructured data consistently.
When you work with document assets such as PDF and Microsoft Word files, you need to be sure that each document carries the sensitivity level appropriate to the data it contains or to the type of document. Rule-based sensitivity assigns a sensitivity classification, such as None, Low, Medium, or High, to document assets based on their data element and document classifications. You can also define a document sensitivity rule to tighten the outcome for documents that meet conditions specific to your business.
Classification inputs for document sensitivity
Document sensitivity draws on two classification mechanisms:
•Data Element Classification. Identifies the sensitive data elements that a document contains, such as SSN or Email. Each data element carries its own sensitivity level.
•Document Classification. Identifies the type of document a file is, such as Medical Record or Board Minutes. You set up Document Classification separately from rule-based sensitivity.
Default sensitivity rollup
A document inherits the highest sensitivity level among the sensitivity levels of the data elements found within it, unless a document sensitivity rule overrules the data element sensitivity. This rollup from Data Element Classification ensures that every document receives a sensitivity classification even if you have not defined a document sensitivity rule.
Document sensitivity rules
A document sensitivity rule sets a minimum sensitivity level for documents that match conditions you set.
A document gets its sensitivity from the data elements that it contains. You can define a document sensitivity rule to set a minimum sensitivity level for documents that match conditions you set. A rule consists of one or more condition rows combined with the AND or OR logic. Each condition row specifies a classification type, either Document Classification or Data Element Classification, with specific classification values defined in your organization. The rule sets a single target sensitivity value for documents that match the conditions.
A document sensitivity rule uses the results of two classifications. Data Element Classification identifies the data elements in a document, and Document Classification identifies the type of document. The rule then sets a minimum sensitivity level for the documents that match.
To view document sensitivity rules, you need the View Data Classifications privilege. To create or manage document sensitivity rules, you need the Manage Data Classifications privilege.
Sample business use case
This example shows how document sensitivity rules and the default sensitivity combine to determine the final sensitivity of documents at a healthcare organization. The classification names and sensitivity levels used in this example are sample values.
A healthcare organization stores patient documents, such as PDF and Microsoft Word files, in a shared file repository. The organization uses a catalog source to add the metadata of the documents to the catalog for further governance. Data element classification detects the personal data in each document, and document classification identifies the type of document. Each data element classification has a sensitivity level, which determines the default sensitivity of a document.
In this organization, the data element classifications for email addresses and phone numbers have a sensitivity of Low, the classification for patient IDs has a sensitivity of Medium, and the classification for Social Security numbers (SSNs) has a sensitivity of High. Without a rule, a document gets the highest sensitivity among its data elements. So an appointment confirmation letter that contains only an email address and a phone number has Low sensitivity.
The organization's compliance policy requires all medical records to be at least of Medium sensitvity, and medical records that contain a patient ID, SSN, or passport number to be of High sensitvity. To ensure compliance, the data governance administrator creates two document sensitivity rules.
The following table describes the rules:
Rule name
Conditions
Sensitivity
Medical records minimum
Document Classification is any of Medical Record, Health Insurance Claim
Medium
Medical records with identifiers
Document Classification is any of Medical Record, Health Insurance Claim AND Data Element Classification is any of Patient ID, SSN, Passport Number
High
The default sensitivity of a document is the highest sensitivity among its data elements. The final sensitivity of a document is the higher of its default sensitivity and the highest sensitivity among the rules that match it.
The following table shows the final sensitivity of the example documents:
Document
Default sensitivity
Matching rules
Final sensitivity
Appointment confirmation letter classified as Medical Record, with an email address and a phone number
Low
Medical records minimum
Medium
Lab results report classified as Medical Record, with a patient ID
Medium
Medical records minimum, Medical records with identifiers
High
Discharge summary classified as Medical Record, with an SSN
High
Medical records minimum, Medical records with identifiers
High
Vendor service agreement, with a phone number
Low
None
Low
The sensitivity level of the appointment confirmation letter rises from Low to Medium because of the Medical records minimum rule. The lab results report sensitvity rises from Medium to High because it contains a patient ID. The vendor service agreement doesn't match any rule, so it keeps its default sensitivity. A rule never lowers a sensitivity, so the discharge summary stays at High sensitvity.
Rule-based sensitivity behavior
Rule-based sensitivity calculates document sensitivity from classifications and rules, and recalculates it automatically when they change.
Document sensitivity calculation
A catalog source job that includes data classification assigns data element and document classifications to documents.
Each classification on a document can have one of the following statuses:
•Accepted: The classification applies to the document. A classification becomes accepted when it is automatically accepted or when a curator accepts it in Data Governance and Catalog.
•Pending: The classification is recommended but no one has accepted or rejected it yet.
•Rejected: A curator rejected the classification for the document.
Rule-based sensitivity considers only accepted data element and document classifications. It ignores pending and rejected classifications. A document with no accepted classifications has no sensitivity value.
A condition row matches a document when the document has at least one of the classifications that you specify in the row. In a condition group that uses AND, every row must match. In a condition group that uses OR, at least one row must match.
Each document has one final sensitivity value, which is the highest of the following values:
•The highest sensitivity among the accepted data element classifications on the document. This is the default.
•The highest sensitivity among the document sensitivity rules that match the document.
A rule sets a minimum sensitivity value, so it can raise the sensitivity of a document above the default but never lower it below the default sensitivity value. When several rules match a document, the highest sensitivity among them applies.
For example, a document sensitivity rule applies to documents classified as Medical Record and sets a sensitivity of Medium. A medical record that contains only data elements with a sensitivity of Low receives a final sensitivity of Medium, because the rule raises it. A medical record that also contains a data element classified as Social Security Number (SSN), which has a sensitivity of High, receives a final sensitivity of High, because the rule never lowers it.
Sensitivity recalculation
Sensitivity recalculates automatically when any of the following changes occur:
•A document gains or loses an accepted classification.
•The sensitivity level of a classification changes.
•You create, edit, delete, enable, or disable a document sensitivity rule.
Recalculation runs in the background, so a change might not take effect immediately.
When you disable a rule, it stops applying to documents. The sensitivity of each document is recalculated without that rule, based on the default sensitivity and any other rules that still match. When you enable the rule again, it applies to matching documents again. When you delete a rule, it stops applying to documents permanently.
When you rename a classification, rules that use it continue to match. When you delete a classification that a rule uses, the rule remains in the Document Sensitivity Rules list and shows the message "This rule refers to a classification that no longer exists." Expand the row to identify the classification.
Create a document sensitivity rule
Create a document sensitivity rule to set a minimum sensitivity level for documents that have the classifications you specify.
1On the Configure page, click the Rule-based Sensitivity tab.
2In the Document Sensitivity Rules panel, click the Add icon.
3On the Overview page, enter a name for the rule.
4Optionally, enter a description.
5To go to the Rules page, click Next.
6In the Condition section, to add a condition row, click Add New.
Select Document Classification or Data Element Classification as the classification type for the row. The Asset Type and Is Any Of fields in the row are read-only.
7To open the classification picker, click Add New next to the condition row.
The picker lists the classification values of the selected type that are defined in your organization. Select one or more values, and click Add Values.
8Optionally, click Add New after the condition row to add another condition.
To change how multiple conditions are evaluated together, select And or Or from the list at the top of the condition group.
9In the Sensitivity section, click Add New next to Sensitivity and select the sensitivity value to apply when the conditions match.
Select from the sensitivity levels configured for your organization, such as None, Low, Medium, or High.
Note:
The final sensitivity is the higher of the rule sensitivity and the highest sensitivity of the data element classifications on the document.
10Click Save.
A new rule has a status of Disabled and doesn't apply to documents until you enable it.
11In the Document Sensitivity Rules list, hover over the rule, click the Action menu, and select Enable.
The rule is enabled and applies to documents.
Manage sensitivity rules
Document sensitivity rules reflect your organization's governance needs, which change over time. On the Rule-based Sensitivity tab, you can find, filter, sort, enable or disable, edit, or delete document sensitivity rules to keep them updated.
You can perform the following actions on the Rule-based Sensitivity tab of the Configure page:
•Find a rule. Enter a search term in the Find field to locate a rule by name.
•Filter the rules. Click the Filter icon and select criteria, such as classification, sensitivity, or status, to narrow the list of rules.
•Sort the rules. Click the Sort icon and select Name, Sensitivity, or Last Updated to sort the list of rules.
•Enable or disable a rule. Hover over the rule, click the Action menu, and select Enable or Disable.
•Edit a rule. Hover over the rule, click the Action menu, and select Edit. Update the rule properties, and save your changes.
•Delete a rule. Hover over the rule, click the Action menu, and select Delete. Confirm the deletion when prompted.