Phase 2: Domain 2 — Asset Security

Government: Top Secret → Secret → Confidential → Unclassified

Commercial: Confidential → Private → Sensitive → Public

Data owner (executive), data custodian (IT), data processor (third party)

Data at rest (encrypted storage — your age/gopass/Vault)

Data in transit (encrypted channels — your EAP-TLS, Vault TLS)

Data in use (memory protection, process isolation)

Create → Store → Use → Share → Archive → Destroy

Retention policies: legal holds, regulatory requirements (HIPAA: 6 years)

Destruction methods: degaussing, shredding, crypto-shredding, overwriting

PII (Personally Identifiable Information)

PHI (Protected Health Information) — your CHLA daily reality

Data minimization, purpose limitation, consent

Privacy impact assessment (PIA)

DPO (Data Protection Officer) — GDPR requirement

Labeling, marking, handling procedures per classification

Scoping and tailoring controls to data sensitivity

Baseline security controls