Box Data Classifications

If you're a content owner, Box enables you to apply a Security Classification Label to your files, and to cascade a classification label to your folders and their contents. Using ISU's classification labels enables you to better protect your shared sensitive content from negligent access.

• Applying a Classification to a File or Folder
• Searching for all Content Bearing a Given Classification

• Public 
• Institutional 
• Critical 
  • Clinic Operations
  • Patient Documentation

• Box Data Classification Decision Tree
• Examples
• Additional resources

Applying a Classification to a File

1. In your Files window, click beside the file's name to highlight it.
2. In the top of the window, select More Options (three-dot menu) Classify.
3. Under Select Classification, click the down arrow and select a classification label. A file can have only one classification label.
4. In the bottom of the window, click Apply.

Applying a Cascading Classification to a Folder

1. In your Files window, click beside the folder's name to highlight it.
2. In the top of the window, select More Options (three-dot menu) Classify.
3. Under Select Classification, click the down arrow and select a classification label. A folder can have only one classification label.
4. To apply your selected classification as a replacement to all existing classifications, click Overwrite all existing classifications with this value.
5. In the bottom of the window, click Apply.

Note: After you apply a classification, Box displays the classification badge under Details in the right-hand sidebar, and next to the file's or folder's name in Preview when people select it or preview its contents.

Source: Using security classification Box Support.

1. In the top of your Box window, in the Search Files and Folders field click the advanced search icon.
2. Select the Metadata tab
3. Under Metadata Template, click Select a Template and select Classification.
4. Under Classification, click Select Value and select the classification label.
5. To launch the search, do one of the following:
   • in the top of your Box window, in the Search Files and Folders field click the search icon (magnification glass), or
   • on your keyboard press Enter .

Source: Using security classification Box Support.

For information intended for public consumption (e.g., Course Catalogs, Press Releases, Campus Maps).

• Definition: Public Data
• Restrictions: No Restrictions

Used for most University business (e.g., Family Educational Rights and Privacy Ace (FERPA) protected student records, Internal Memos, Departmental Budgets, Non-sensitive Research). 

• Note: Institutional - No Watermark is the same, but does not add an ISU watermark on the files.  It is also the main default label when files are unclassified.

• Shared link: Idaho State University & External Collaborators only.
• External Collaboration: Allow Specified Domains and external users only.
  • Note: Justification for external collaboration available.
• Download & Print: External partners restricted.
• Application integration: Restricted
• FTP: Restricted
• Watermarking: Enabled

Critical data includes highly regulated or sensitive information such as:

• Bank account numbers.
• HIPAA - protected or other health information.
• Social Security numbers (SSNs).
• Proprietary intellectual property (IP).

There are four different types of Critical classifications:

• Critical: for highly regulated or sensitive data, such as SSNs, HIPAA data, or banking numbers.
• Critical - No Watermark: same as Critical, but without an ISU watermark. 
  • Note: Unclassified files with SSNs, banking numbers, etc. will be automatically assigned this label.
• Critical - Patient Documentation: meant to store patient documents containing ICD-10 medical codes, among other things. 
  • Note: Unclassified files with such codes will be automatically assigned this label.
• Critical - Clinic Operations: to store printable clinic documents.

• Shared link: Internal Collaborators Only
• External Collaboration: Restricted
• Download & Print: External Partners Restricted, Mobile Devices restricted to Owner/co-owner
• Application integration: Restricted
• FTP: Restricted
• Watermarking: Enabled

• *Patient Documentation further restricts downloading and printing.
• Clinic Operations allows printing.

Follow the path that best describes the most sensitive piece of information in your file or folder.

1. Does the data contain any of the following?

• Social Security Numbers (SSNs)
• Health/Medical Records (HIPAA)
• Credit Card/Financial Account Numbers
• Biometric Data or Passport IDs
• YES: Label: CRITICAL (Strict Access)
• NO: Go to Question 2

• Student Education Records (FERPA, e.g., Grades, Transcripts)
• Unpublished Research Data
• University Budgets or Internal Memos
• Employee IDs or Home Addresses
• YES: Label: CRITICAL (Strict Access)
• NO: Go to Question 3

• Course Catalogs
• Campus Maps or Press Releases
• Publicly available Policy Manuals
• YES: Label: PUBLIC (Open Sharing)
• UNSURE: Default to: INSTITUTIONAL (Safety first)