Data Classification: Legal criteria

["Basgen, Brian" <bbasgen () PIMA EDU>]

 We are in the process of developing a data classification policy with
three types: public, internal, and confidential.

 The criteria or logic behind classifying confidential data is fairly
easy: FERPA, GLBA, PCI, etc, requires the confidentiality of certain
data types. Yet, I am not clear on the best external criteria to use for
classification of internal data. Peer institutions, "best practices" is
one thought, but I'm wondering what other objective criteria people have
employed for the justification of making certain kinds of data internal
as opposed to public. Let me know, thanks.  

~~~~~~~~~~~~~~~~~~
Brian Basgen
Information Security
Pima Community College