# Data Classification Policy
# Cold Bore Ballistics LLC — Internal Reference
# Classification: Confidential

Subordinate to: `CBB_Information_Security_Policy.md` §7

---

## 1. Purpose and Scope

This policy defines how CBB classifies its information assets and the handling rules that apply to each classification tier. It applies to all data created, stored, processed, or transmitted by CBB, regardless of medium or location.

---

## 2. Classification Tiers

CBB uses a four-tier classification system. The tiers map directly to the OneDrive directory structure. When in doubt about the correct tier for a document, default to **Confidential**.

### Tier 1 — Public

Information that is approved for unrestricted public distribution.

**Examples:**
- ScopeDOPE and CBB marketing materials
- Public website content
- `dope-format` format specification and JSON schema
- Published press releases

**Handling:** No restrictions on distribution. May be shared externally without approval. May be published to public repositories.

### Tier 2 — General

Information intended for internal use that is not sensitive, and may be shared with contractors, partners, or vendors under NDA.

**Examples:**
- Internal process documentation not covering infrastructure or financials
- Non-sensitive vendor communications
- General onboarding materials

**Handling:** Internal use by default. May be shared with contractors or partners under a signed NDA. Must not be published publicly without explicit approval.

### Tier 3 — Confidential

Sensitive operational, financial, legal, and infrastructure information. Exposure of Confidential data could cause material harm to CBB's competitive position, legal standing, or acquisition value.

**Examples:**
- This policy suite
- Infrastructure architecture references, runbooks, and rebuild guides
- Financial records and projections
- Legal templates, operating agreements, and trademark filings
- Vendor security reviews and risk register
- App registration credentials and inventory
- Employee and contractor records

**Handling:**
- Internal use only
- Must not be quoted or referenced in public channels, commits, issue trackers, or external communications
- Must not be stored outside the `03_-_Confidential/` OneDrive tier without explicit approval
- May be shared with legal counsel, auditors, or acquisition due diligence teams under a signed NDA and on a need-to-know basis

### Tier 4 — Highly Confidential

Trade secrets and proprietary intellectual property whose exposure would cause severe and potentially irreversible harm to CBB's competitive position or the value of its IP.

**Examples:**
- The ScopeDOPE SPEC (`SPEC.md`, `SPEC_data_engine.md`, `SPEC_features.md`, `SPEC_nonfunc_appendices.md`)
- Ballistics engine internals
- DOPE-Blend™ methodology and algorithm details
- Pre-patent invention disclosures

**Handling:**
- Strictly need-to-know
- Must never be committed to any git repository
- Must never be referenced in READMEs, commit messages, Jira tickets, Slack, or any other system outside the `04_-_Highly_Confidential/` OneDrive tier
- Disclosure to any external party requires a signed NDA and explicit written approval from the Global Administrator
- Subject to heightened access controls — review annually to confirm access list is current

---

## 3. Namespace Separation

CBB maintains two OneDrive namespaces:

| Namespace | Holds |
|---|---|
| `CBB_Corporate/` | Company operations, infrastructure, legal, finance, process, brand |
| `ScopeDOPE/` | Product strategy, design, engine documentation, marketing, SPEC |

Content must not be moved between namespaces without explicit approval. CBB Corporate assets must not be stored under `ScopeDOPE/` and vice versa.

---

## 4. Labeling

Every document created for internal use must include its classification tier in the document header:

```
# Classification: Public
# Classification: General
# Classification: Confidential
# Classification: Highly Confidential
```

Documents without a classification header are treated as **Confidential** until explicitly reclassified.

---

## 5. Retention

| Tier | Minimum retention | Notes |
|---|---|---|
| Public | No minimum | Retain as long as content is current or historically relevant |
| General | 3 years | Align with M365 Purview email retention policy |
| Confidential | 7 years | Covers legal, financial, and contractual obligations |
| Highly Confidential | Indefinite | IP and trade secrets retained until explicitly abandoned or expired |

Retention applies to the document regardless of its storage location. Deleting a Confidential or Highly Confidential document before the retention period expires requires approval from the Global Administrator.

---

## 6. Reclassification

A document may be reclassified to a lower tier (e.g., Confidential → General) only with explicit approval from the Global Administrator. Reclassification must be documented in the document's control block with the approver and date.

A document may never be reclassified to a higher tier retroactively to excuse a prior handling violation — the violation must be assessed and documented separately.

---

## Document Control

| Field | Value |
|---|---|
| **Document owner** | `jschwefel@coldboreballisticsllc.com` |
| **Classification** | Confidential (03_-_Confidential/) |
| **Location** | `OneDrive/CBB_Corporate/03_-_Confidential/Security/Data_Classification_Policy.md` |
| **Cross-references** | `CBB_Information_Security_Policy.md`; `ONEDRIVE_ORGANIZATION_GUIDE.md` |
| **Created** | 2026-06-07 |
| **Last updated** | 2026-06-09 |
| **Next full review due** | 2027-06-07 |

---

## Revision Control Block

| Rev | Date | Changed By | Reviewed By | Approved By | Summary |
|-----|------|------------|-------------|-------------|---------|
| 0.9 | 2026-06-07 | jschwefel | — | — | Initial release |
| DRAFT | 2026-06-09 | Claude Code | — | — | Removed non-standard `# Last Updated` header line (per TECHNICAL_DOCUMENTATION_GUIDE §7). No content changes. |
