1. Purpose

The Confidentiality Requirements Matrix defines the minimum confidentiality and information-protection requirements that apply to information based on its classification, sensitivity, business purpose, and method of use or sharing.

The matrix helps ensure that employees, contractors, suppliers, customers, partners, and other authorized parties understand how information must be accessed, stored, transferred, disclosed, retained, and securely disposed of.

Core Principle

Classify → Determine Requirements → Authorize Access → Protect → Share Securely → Monitor → Retain/Delete → Verify

---

2. Scope

This matrix applies to information handled by:

• Employees
• Contractors
• Consultants
• Interns
• Temporary workers
• Suppliers
• Service providers
• Partners
• Customers
• Auditors
• Advisors
• Other authorized third parties

It applies to information stored or processed in:

• Laptops and desktops
• Mobile devices
• Cloud platforms
• SaaS applications
• Databases
• Source-code repositories
• Email
• File-sharing platforms
• Paper documents
• Removable media
• APIs
• Production environments
• Backup systems
• Collaboration platforms

---

3. Information Classification Levels

The organization may use the following classification levels.

Classification	General Description	Typical Impact if Disclosed
Public	Information approved for public disclosure	Low
Internal	Information intended for internal business use	Low/Medium
Confidential	Sensitive business, customer, technical, or operational information	Medium/High
Restricted	Highly sensitive information requiring enhanced protection	High/Critical

The organization’s approved Information Classification Policy should be the authoritative source for classification definitions.

---

4. Master Confidentiality Requirements Matrix

Requirement	Public	Internal	Confidential	Restricted
Authorized access required	No	Yes	Yes	Yes
Need-to-know principle	Recommended	Yes	Yes	Strict
Named-user access	Recommended	Yes	Yes	Mandatory where practical
Shared accounts	Generally acceptable only where appropriate	Avoid	Prohibited unless specifically approved	Prohibited except controlled emergency use
MFA	Where applicable	Where applicable	Required for sensitive systems	Mandatory where technically applicable
Encryption in transit	Recommended	Recommended	Required for sensitive transfers	Required
Encryption at rest	Not normally required	Based on risk	Required where appropriate	Required
Secure file transfer	Not normally required	Recommended	Required	Required
External sharing	Publicly permitted	Authorized recipients	Explicit authorization	Explicit approval
Third-party disclosure	Permitted	Controlled	Contractual/authorized	Formal approval and contractual controls
Personal device storage	Generally permitted	Restricted	Only if approved and protected	Normally prohibited
Public cloud storage	Permitted where intended	Approved services	Approved services only	Approved and specifically controlled
Public AI tools	Permitted for public information	Only where approved	Prohibited unless explicitly approved	Prohibited unless formally approved
Source-code repositories	Public repositories where intentionally released	Private repositories	Approved private repositories	Highly restricted repositories
Email sharing	Permitted	Internal/approved recipients	Secure transmission required	Avoid where possible; approved secure channel
Printing	Permitted	Controlled	Restricted	Strictly controlled
Physical storage	No special requirement	Controlled	Secure storage	Locked/controlled storage
Logging	Normally not required	Risk-based	Required for sensitive access where appropriate	Required
Monitoring	Normally not required	Risk-based	Required where appropriate	Enhanced monitoring
Data retention	Business need	Defined	Defined	Strictly defined
Secure disposal	Normal disposal	Controlled disposal	Secure disposal	Secure destruction/deletion
Incident reporting	Required	Required	Immediate/priority reporting	Immediate/priority reporting
NDA/confidentiality agreement	Not normally required	Where appropriate	Normally required for external parties	Required
Access review	Not normally required	Periodic	Periodic	Frequent/risk-based
Data loss prevention	Not normally required	Risk-based	Recommended/required where appropriate	Required where appropriate
Regulatory restrictions	Usually low	May apply	May apply	Frequently applicable

---

5. Public Information Requirements

Definition

Information intentionally approved for public disclosure.

Examples:

• Public website content
• Published marketing material
• Public documentation
• Published job advertisements
• Public press releases
• Public product information

Minimum Requirements

☐ Information approved for public release

☐ No confidential information included

☐ No personal information unnecessarily exposed

☐ No credentials or security secrets included

☐ No internal architecture unnecessarily disclosed

☐ No restricted customer information included

Disclosure

Public information may be shared externally without additional confidentiality approval where it has been formally approved for public release.

---

6. Internal Information Requirements

Definition

Information intended primarily for authorized personnel within the organization.

Examples:

• Internal procedures
• Internal meeting notes
• Internal operational information
• Non-public employee communications
• Internal project documentation
• Internal process information

Requirements

☐ Authorized personnel access

☐ Appropriate authentication

☐ Approved storage locations

☐ Controlled external sharing

☐ Secure disposal

☐ No unnecessary public disclosure

External Disclosure

External disclosure should require appropriate authorization.

---

7. Confidential Information Requirements

Definition

Information that could cause meaningful business, security, privacy, financial, contractual, or reputational impact if improperly disclosed.

Examples:

• Customer information
• Supplier information
• Business plans
• Contracts
• Pricing
• Security assessments
• VAPT reports
• Product roadmaps
• Technical architecture
• Non-public source code
• Internal audit reports

Requirements

☐ Need-to-know access

☐ Named user access where practical

☐ Strong authentication

☐ MFA for relevant systems

☐ Approved storage

☐ Encryption during sensitive transmission

☐ Encryption at rest where appropriate

☐ Controlled external sharing

☐ NDA/confidentiality requirements where applicable

☐ Secure disposal

☐ Security incident reporting

☐ Periodic access review

---

8. Restricted Information Requirements

Definition

Information where unauthorized access or disclosure could create significant or critical impact.

Examples:

• Production credentials
• Privileged credentials
• Encryption keys
• API secrets
• Highly sensitive customer data
• Sensitive personal data
• Unreleased security vulnerabilities
• Critical security architecture
• Major incident investigation evidence
• Highly sensitive intellectual property

Requirements

☐ Strict need-to-know access

☐ Individual named accounts

☐ MFA

☐ Privileged access controls

☐ Strong authentication

☐ Encryption

☐ Approved storage only

☐ Secure transfer

☐ Enhanced logging

☐ Access monitoring

☐ Periodic access review

☐ Formal authorization for external disclosure

☐ Secure deletion

☐ Incident escalation

☐ Evidence preservation where required

---

9. Access Control Matrix

Access Requirement	Public	Internal	Confidential	Restricted
General access	Open	Authorized users	Need-to-know	Strict need-to-know
Manager approval	Not normally required	Where appropriate	Required where applicable	Required
System owner approval	No	Where appropriate	Recommended	Required
Privileged access	Not applicable	Limited	Restricted	Highly restricted
Temporary access	Not normally required	Recommended where appropriate	Preferred	Required where practical
Access expiry	No	Risk-based	Required for temporary access	Required
Periodic review	No	Periodic	Periodic	Frequent/risk-based
Emergency access	Not applicable	Controlled	Controlled	Strictly controlled and logged

---

10. Storage Requirements Matrix

Storage Location	Public	Internal	Confidential	Restricted
Public website	Allowed	Prohibited unless approved	Prohibited	Prohibited
Corporate file storage	Allowed	Allowed	Approved location	Approved restricted location
Approved SaaS	Allowed	Allowed	Approved services	Explicitly approved services
Personal cloud storage	Generally unnecessary	Restricted	Prohibited unless approved	Prohibited
Local workstation	Allowed	Allowed	Protected	Restricted
Removable media	Allowed	Controlled	Restricted	Normally prohibited
Source-code repository	Public if intentionally public	Private	Private restricted	Highly restricted
Backup	As applicable	Required where appropriate	Protected	Strongly protected

---

11. Information Transfer Matrix

Transfer Method	Public	Internal	Confidential	Restricted
Public website	Yes	No	No	No
Normal email	Yes	Controlled	Avoid unless protected	Avoid
Encrypted email	Yes	Yes	Yes	Where approved
Approved file sharing	Yes	Yes	Yes	Yes, if authorized
Secure API	Yes	Yes	Yes	Yes
Public file-sharing link	Yes	No	No	No
Encrypted transfer	Optional	Recommended	Required	Required
Physical delivery	Optional	Controlled	Secure delivery	Secure tracked delivery

---

12. Third-Party Disclosure Matrix

Requirement	Public	Internal	Confidential	Restricted
External disclosure	Allowed if approved for public release	Authorization required	Formal authorization	Formal approval
NDA	Usually unnecessary	Where appropriate	Normally required	Required
Security review	No	Risk-based	Recommended	Required where appropriate
Supplier assessment	No	Risk-based	Required for relevant suppliers	Required
Data-processing agreement	No	If personal data applies	If personal data applies	Required where applicable
Subprocessor review	No	Where applicable	Required where applicable	Required
Disclosure logging	Not normally required	Risk-based	Recommended	Required where appropriate

---

13. Customer Information Requirements

Where customer information is classified as Confidential or Restricted:

☐ Customer requirements identified

☐ Contractual confidentiality requirements reviewed

☐ Customer data minimized

☐ Access restricted

☐ Approved storage used

☐ Secure transfer used

☐ Encryption considered/implemented

☐ Retention defined

☐ Deletion/return requirements defined

☐ Incident notification requirements understood

☐ Subprocessor requirements considered

---

14. Personal Data Requirements

Where personal data is involved:

☐ Processing purpose identified

☐ Data minimization applied

☐ Access restricted

☐ Appropriate security controls implemented

☐ Retention defined

☐ Secure deletion defined

☐ External disclosure controlled

☐ Applicable privacy requirements identified

☐ International transfer requirements assessed where applicable

☐ Data-processing agreement completed where required

---

15. Security Credentials and Secrets

The following should normally be treated as Restricted:

• Passwords
• API keys
• Access tokens
• SSH private keys
• Cloud credentials
• Encryption keys
• Database credentials
• Signing keys
• Certificates containing private keys
• Break-glass credentials

Requirements

☐ Named access where possible

☐ MFA

☐ Secure secrets storage

☐ No storage in source code

☐ No sharing through unsecured channels

☐ Rotation

☐ Revocation

☐ Access logging

☐ Compromise response

---

16. Source Code Requirements

Non-public source code should normally be classified as Confidential or Restricted, depending on business impact.

Requirements

☐ Private repository

☐ Named users

☐ Need-to-know access

☐ MFA

☐ Branch/repository protection

☐ Access review

☐ No unauthorized copying

☐ No upload to public repositories

☐ No submission to unapproved AI services

☐ Secure backup

☐ Access revocation during offboarding

---

17. Security Vulnerability Information

Information relating to vulnerabilities should receive enhanced protection.

Examples:

• VAPT findings
• Exploit details
• Security weaknesses
• Unpatched vulnerabilities
• Penetration-test reports
• Security incident investigation details

Requirements

☐ Restricted access

☐ Need-to-know

☐ Secure storage

☐ Secure transfer

☐ Controlled external disclosure

☐ Appropriate remediation tracking

☐ No public disclosure before authorization

---

18. AI and Generative AI Requirements

Before entering information into an AI or external processing service, determine:

Question	Requirement
Is the information Public?	Generally permitted subject to policy
Is it Internal?	Use only approved services
Is it Confidential?	Explicit approval may be required
Is it Restricted?	Normally prohibited unless specifically authorized
Is personal data involved?	Privacy/legal assessment required
Is customer data involved?	Customer/contractual requirements must be considered
Is source code involved?	Approved AI service required
Is security information involved?	Enhanced approval required

Prohibited Practice

Do not paste passwords, API keys, customer data, private source code, or sensitive security findings into an unapproved public AI service.

---

19. Remote Work Requirements

For Confidential and Restricted information:

☐ Authorized devices only

☐ Strong authentication

☐ MFA where applicable

☐ Device encryption

☐ Secure network access

☐ Screen/privacy protection

☐ No unauthorized family/shared access

☐ Approved cloud storage

☐ Secure physical handling

☐ Secure disposal

---

20. Printing Requirements

Classification	Printing Requirement
Public	No special restriction
Internal	Controlled where appropriate
Confidential	Minimize printing; secure storage
Restricted	Printing only when necessary and authorized

Printed Confidential or Restricted information should not be left unattended.

---

21. Retention and Disposal Matrix

Requirement	Public	Internal	Confidential	Restricted
Retention based on business need	Recommended	Yes	Yes	Strictly defined
Retention schedule	Optional	Recommended	Required where applicable	Required
Normal disposal	Yes	Controlled	Secure disposal	Secure destruction/deletion
Data deletion verification	No	Risk-based	Where required	Where appropriate
Legal hold consideration	Yes	Yes	Yes	Yes

---

22. Security Incident Requirements

Any suspected unauthorized disclosure should be reported through the organization’s incident-management process.

Examples

• Wrong recipient received an email;
• Confidential document sent to an unauthorized person;
• Laptop containing Restricted information was lost;
• Customer data was uploaded to an unapproved service;
• Source code was exposed publicly;
• Credentials were accidentally disclosed;
• Confidential information was shared with an unauthorized supplier.

Required Actions

Report → Contain → Assess → Preserve Evidence → Notify → Remediate → Record → Review

---

23. Third-Party Confidentiality Requirements

Before providing Confidential or Restricted information to an external party:

☐ Business need identified

☐ Third party identified

☐ Information classified

☐ Access scope defined

☐ NDA/confidentiality agreement reviewed

☐ Security requirements defined

☐ Personal-data requirements assessed

☐ Supplier risk assessed where applicable

☐ Secure transfer method defined

☐ Retention/deletion requirements defined

☐ Incident notification requirements defined

---

24. Contractual Requirements

Contracts involving Confidential or Restricted information should address relevant requirements such as:

• Confidentiality
• Information security
• Access control
• Data protection
• Incident notification
• Subprocessors
• Data location
• Data retention
• Data deletion
• Return of information
• Security assurance
• Audit rights where appropriate
• Business continuity
• Termination
• Exit requirements

---

25. Evidence Requirements

The organization should retain appropriate evidence demonstrating that confidentiality requirements are implemented.

Examples:

☐ Classification records

☐ Access approvals

☐ Access review records

☐ NDA records

☐ Supplier agreements

☐ Data-processing agreements

☐ Secure transfer records

☐ Security assessment records

☐ Incident records

☐ Deletion confirmations

☐ Offboarding records

☐ Security training records

☐ Policy acknowledgements

☐ Exception approvals

Evidence should not unnecessarily contain passwords, API keys, private keys, or other secrets.

---

26. Responsibility Matrix

Activity	Information Owner	IT/Security	Employee/User	Supplier
Classification	A/R	C	C	C
Access approval	A/R	C	I	C
Access provisioning	I	A/R	I	C
Secure handling	A	C	R	R
Secure transfer	A	C/R	R	R
External disclosure	A/R	C	I	C
Incident reporting	A	R	R	R
Retention	A/R	C	I	C
Secure disposal	A	R	R	R
Periodic review	A/R	R	C	C

R = Responsible
A = Accountable
C = Consulted
I = Informed

---

27. Exception Management

Where the standard confidentiality requirements cannot be implemented:

1. Document the exception.
2. Identify the reason.
3. Assess the risk.
4. Define compensating controls.
5. Obtain appropriate approval.
6. Define an expiry/review date.
7. Record the exception.

Exception Record

Field	Details
Exception ID
Information
Classification
Requirement
Reason
Risk
Compensating Control
Owner
Approver
Expiry/Review Date
Status

---

28. AWS SaaS Startup Example

An AWS SaaS startup classifies the following information:

Information	Classification	Key Requirements
Public website content	Public	Approved for public release
Internal sprint plan	Internal	Authorized internal access
Customer contract	Confidential	Need-to-know, secure storage
VAPT report	Restricted	Strict access, secure transfer
AWS architecture	Confidential	Restricted access, approved sharing
Production database credentials	Restricted	Secrets manager, MFA, logging
API key	Restricted	Secure storage, rotation
Public API documentation	Public	Approved publication
Customer personal data	Confidential/Restricted	Privacy + access controls
Source code	Confidential/Restricted	Private repository, MFA
Security incident evidence	Restricted	Strict access, evidence preservation

Practical Example

A developer needs to share an AWS architecture diagram with a VAPT provider.

The process should be:

Classify → Verify Provider → NDA → Approve Access → Secure Transfer → Limit Access → Review → Revoke/Return

The diagram should not simply be attached to an unrestricted email or uploaded to a public file-sharing service.

---

29. Startup-Friendly Implementation Model

A startup does not need a complicated confidentiality framework.

Start with four clear rules:

Rule 1 — Classify

Every important information asset should have a classification.

Rule 2 — Restrict

Confidential and Restricted information should only be accessible to people who need it.

Rule 3 — Protect

Use appropriate authentication, encryption, secure storage, and secure transfer.

Rule 4 — Close

When access or business need ends, remove access and return/delete information as required.

Startup Minimum Controls

☐ Information classification policy

☐ Confidentiality/NDA requirements

☐ Access control

☐ MFA

☐ Approved cloud storage

☐ Secure file sharing

☐ Secure secrets management

☐ Employee/contractor offboarding

☐ Supplier confidentiality requirements

☐ Incident reporting

☐ Secure disposal

---

30. Common Mistakes

Avoid:

• Treating all information as equally sensitive.
• Marking everything “Confidential” without defining handling requirements.
• Granting access based on convenience.
• Sharing customer data when test data would be sufficient.
• Sending Restricted information through normal email.
• Storing credentials in documents or source code.
• Uploading confidential information to public AI tools.
• Allowing suppliers unrestricted access.
• Forgetting to revoke access after a project ends.
• Keeping confidential information indefinitely.
• Failing to document exceptions.
• Assuming an NDA alone protects information.
• Keeping audit evidence that contains actual passwords or secrets.

---

31. Relationship With Other ISMS Documents

Document	Relationship
Information Classification Policy	Defines classification principles
Information Classification Register	Records classified information
Confidentiality and NDA Policy	Defines confidentiality obligations
Employee NDA	Protects employee-handled information
Contractor NDA	Protects contractor-handled information
Supplier Confidentiality Agreement	Protects supplier-shared information
Access Management Procedure	Controls access
Information Transfer Procedure	Controls information exchange
Data Retention Policy	Defines retention requirements
Secure Disposal Procedure	Defines secure destruction
Incident Response Procedure	Handles unauthorized disclosure
Supplier Security Requirements	Defines third-party protection
Employee Offboarding Policy	Supports access and information protection at exit
Data Processing Agreement	Addresses personal-data processing

---

32. ISO 27001 / SOC 2 Connection

The Confidentiality Requirements Matrix supports the organization’s broader information-security framework by translating information classification into practical protection requirements.

It can provide evidence that the organization has considered:

• Information classification;
• Access control;
• Need-to-know;
• Information transfer;
• Confidentiality obligations;
• Supplier/third-party protection;
• Secure disposal;
• Incident management;
• Data protection;
• Security monitoring.

The matrix itself is not a substitute for the organization’s risk assessment, policies, procedures, or applicable ISO 27001/SOC 2 controls.

The organization should determine the controls and requirements appropriate to its specific risks, services, information, contractual obligations, and regulatory environment.

---

33. Quick Audit Checklist

☐ Information classification defined

☐ Classification levels approved

☐ Confidentiality requirements documented

☐ Access requirements defined

☐ Need-to-know implemented

☐ MFA requirements defined

☐ Encryption requirements defined

☐ Secure transfer requirements defined

☐ Third-party disclosure requirements defined

☐ NDA requirements defined

☐ Customer data requirements defined

☐ Personal-data requirements defined

☐ AI/external-service requirements defined

☐ Source-code requirements defined

☐ Credential/secret requirements defined

☐ Retention requirements defined

☐ Secure disposal requirements defined

☐ Incident reporting defined

☐ Exception process defined

☐ Evidence requirements defined

☐ Periodic review established

---

34. Document Control

Field	Details
Document Name	Confidentiality Requirements Matrix
Document Owner
Version
Effective Date
Review Frequency
Approved By
Classification	Internal
Next Review Date
Status	Draft / Approved / Retired

---

35. Final Audit Trail

For every significant category of information, the organization should be able to demonstrate:

What information is it?
How is it classified?
Who owns it?
Who can access it?
Why do they need access?
Where can it be stored?
How can it be transferred?
Can it be shared with third parties?
What contractual requirements apply?
Can it be processed using AI or external services?
How long should it be retained?
How should it be deleted or destroyed?
What happens if it is disclosed accidentally?
What evidence demonstrates that the requirements were followed?

Final Principle

Classification has value only when it changes how information is handled. The Confidentiality Requirements Matrix converts labels such as Public, Internal, Confidential, and Restricted into clear, measurable security requirements that users and third parties can actually follow.