Data Centric Security -- Data Labelling

Overview#

The DCS Data Labelling module implements security classification labelling, metadata binding, and attribute-based access control across all data objects in the platform. It ensures that every piece of data carries appropriate security markings and that access decisions are enforced in real-time based on user clearance, organisational affiliation, and data classification level.

Key Features#

Security Classification Labels#

Automated label assignment based on data source and content analysis. Support for multiple classification schemes including NATO levels (UNCLASSIFIED, RESTRICTED, CONFIDENTIAL, SECRET), EU equivalents (RESTREINT UE, CONFIDENTIEL UE, SECRET UE), and national classification scheme mapping per participating nation.

Label Lifecycle Management#

Label creation with integrity verification, modification audit trails with approver chains, declassification workflows with time-based and event-based triggers, and bulk re-labelling with authorisation controls.

Metadata Binding#

Tamper-evident binding of security labels to data objects ensuring that classification markings cannot be separated from or altered independently of the data they protect. Support for XML and JSON label encoding formats with metadata inheritance for derived data products.

Attribute-Based Access Control#

Real-time access evaluation through Policy Decision Points with enforcement at all data access layers. Dynamic policy updates without service interruption. Support for complex access rules combining classification level, nationality, organisational role, and compartment membership.

Label Schema#

Labels include policy identifier, classification level, category markings (compartments, codewords), release markings (RELTO nations), and handling instructions following international confidentiality label standards.

Use Cases#

• Multi-National Operations: Apply consistent classification labelling across data shared between participating nations, with automated enforcement of release markings and handling restrictions.
• Data Sovereignty Compliance: Ensure all data objects carry appropriate national classification markings and that access is restricted to authorised personnel with appropriate clearance.
• Declassification Management: Automate declassification workflows based on time triggers, events, or manual review, maintaining audit trails of all classification changes.
• Cross-Domain Sharing: Enable controlled sharing of classified data across security domains with attribute-based access mediation and complete audit logging.

Integration#

Supports integration with external classification engines and policy management systems. Event-driven label change notifications enable downstream systems to respond to classification updates.

Last Reviewed: 2026-02-24