P2/P3 Data Classification Task Force

Create practical documentation (e.g., decision trees, flowcharts, and concise examples) to help users consistently classify data across common use cases. Current ambiguity in classification criteria leads to inconsistent handling of sensitive data and increases institutional risk. Standardized, easy-to-navigate guidance will improve compliance, reduce user burden, and promote more uniform decision-making.

• Future enhancement: Explore AI-assisted tools to support (not replace) data classification workflows. Such tools could suggest preliminary classifications based on dataset characteristics but should be positioned strictly as decision support.

Develop targeted guidance to help researchers determine when to use open versus controlled-access repositories for P2–P4 data. This should include key decision factors and align with institutional and sponsor expectations. Clear recommendations will reduce uncertainty and help ensure appropriate data stewardship while enabling responsible data sharing.

Given limited staffing, prioritize scalable support for quantitative and qualitative data de-identification by developing clear, standardized guidance and self-service resources for researchers, including practical methods for evaluating and mitigating re-identification risk.

Curate and adapt existing best practices from peer institutions and widely used research tools to provide applied methods for both quantitative and qualitative data.

Expand the web-based inventory to show which security/compliance standards (e.g., NIST) each system meets. Add clear groupings for P1 and P2 data to help researchers quickly identify suitable, compliant platforms and reduce misalignment.

Collaborate with the ITOM Project Team to explore documenting the data classification level for all IT systems in a central location, such as the CMDB or IT Service Catalog.