How is data typically managed under Annex F in terms classification and labeling?

• A. Data is categorized by size only.
• B. Data is categorized by sensitivity and criticality; labeling identifies handling requirements and security controls.
• C. All data must be encrypted at rest regardless of classification.
• D. Data labeling is optional and unregulated.

Answer: (B)

Classification and labeling of data under Annex F means you assign how sensitive the information is and how critical it is to operations, then attach a label that communicates the exact handling requirements and the security controls that must be in place. This approach ensures that everyone who handles the data knows what protections are needed, who can access it, and how it should be stored, transmitted, or disposed of.

Understanding sensitivity and criticality helps tailor protections to risk. Sensitive information, if exposed, could cause harm or breach obligations, so it demands stronger controls. Criticality relates to how vital the data is to mission success or operations; higher criticality justifies tighter access and stricter safeguards. The labeling acts as a practical, visible guide—marking the data with its category and the required behaviors, such as encryption, access restrictions, transmission rules, and retention.

Why this is the best fit: it directly links the risk-based categorization to concrete, enforceable handling instructions. You don’t rely on data size or blanket rules; you apply proportional protections based on the data’s value and risk, and the label makes these requirements observable and actionable.

Why the other ideas don’t fit: categorizing by size misses the security-relevant factors; whether data is large or small has no intrinsic relation to risk or required controls. Requiring encryption for all data at rest regardless of classification is inflexible and unnecessary for low-risk data, and it can impose unnecessary complexity and performance costs. Treating labeling as optional would undermine consistent protection—without mandatory labels, people wouldn’t know the correct handling or controls to apply.

In short, this approach ensures data is protected in proportion to its risk, with clear, enforced instructions on how to handle it.