Security risks are becoming increasingly more complex, placing greater emphasis on protecting your organization’s sensitive information. Sensitivity labels offer your organization a structured way to classify, manage, and secure your data. Learn how to use sensitivity labels to maintain control over confidential information, facilitate secure sharing, and ensure compliance.

Sensitivity labels are a custom set of rules that classify and protect your organization’s data, including documents, emails, and Microsoft Teams content. Labels define confidentiality levels and provide guidance on data handling and sharing privileges to enhance security and compliance.

For sensitivity labels to be effective, you must create an intuitive classification system that supports both usability and security. Labels should clearly signify different levels of security, from public information to highly confidential content. For example, if you have three levels of security, you might name these labels: “public,” “sensitive,” and “restricted.”

Once you have established your basic sensitivity labels, you can customize them further by leveraging sublabels. They provide flexibility for more complex workflows and guide users to make more accurate, context-sensitive choices without feeling overwhelmed with too many options. For example, if the parent label is “sensitive,” you could create sublabels “internal only” and “executives only.” Creating sublabels forces users to select one of the sublabels and cannot simply choose the parent label, which is more of a guide to help them select the correct label.

After organizing your labels, you must configure them to meet the needs of your organization. Sensitivity labels can be assigned to specific groups or users, allowing for customized settings and labels according to the sensitivity level of each team. This means that settings such as default sensitivity labels and which labels appear can be tailored for each user or team, so teams handling more sensitive data can default to a higher sensitivity label while teams constantly sharing information externally can have a lower sensitivity label by default. Be sure to include the “Learn More” button to help users understand what each label means and in what situations each should be used.

To build on the default sensitivity labels, you can require justification to lower a document or email chain’s security level. This ensures that users don’t accidentally change the sensitivity level and that changes are only made when necessary.

Sensitivity labels are stored as clear text in the metadata of documents. This means labels and, therefore, classification and security will stay attached to files even after being transferred between users, saved in various locations, or even on third-party applications. To illustrate this with an example, if a file was given the “Restricted,” or top-level of security, after being created, regardless of if the file is saved on your personal device, emailed or messaged to another user, or saved in a third-party app such as DropBox, the sensitivity label will remain intact, maintaining its original level of security.

To maximize the benefits of sensitivity labels, organizations should adopt a few best practices. Firstly, set a comfortable level of security as the default label for documents. This ensures that all documents will have a level of security that protects your organization but doesn’t restrict access too much. Users could still change the label, but this ensures a baseline level of protection.

Next, when you are creating groups to customize settings, consider the typical level of sensitivity in the data they are handling rather than the team they belong to. While some teams will all access similar levels of sensitive data, others may have some members more internally facing with others externally facing. Creating these groups helps to avoid overwhelming users with label choices while also ensuring all employees can select the most appropriate level of security for their needs.

Lastly, conduct regularly scheduled audits and training sessions regarding sensitivity levels. Reviewing label usage across your organization can help identify inconsistencies amongst employees and allow you to delete labels not being used, create helpful sublabels to help specify security needs, and reduce confusion amongst users. Conducting training sessions is especially valuable when the sensitivity labels are first introduced to help familiarize employees with the different labels, settings, and implications.

Sensitivity labels have become an essential tool in the modern workspace to ensure compliance and protection of sensitive information. Empower your teams to handle data responsibly by setting up these labels to safeguard from breaches and maintain the trust you have worked so hard to gain. Start implementing and managing sensitivity labels today to make your organization more secure.