All data is classified automatically as soon as it is created or ingested, with classification permanently switched on, with automatic discovery of personally identifiable information, information sensitivity classes, material non-public information, client identifiable information and organization-defined classifications. Automation opportunities: classify every item of data that arrives in the cloud, whether migrated or newly created; rely on automated classifiers; support the organization's own schemes; default to the highest classification until reviewed and changed. Certification test steps: confirm the catalog exists and scanning recurs; report sensitivity classifications aligned to the control; confirm that assets with no sensitivity are correctly so; verify on a random sample that classifications are accurate; create an asset and confirm an entry is generated and classification triggered; change an asset so its classification should change and confirm the update after the next scan.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.