How do you determine the strategic importance of your data?

All companies have strategic data: characteristic or technical data of a product, information about the launch of a new product or service, positioning of the company, customer databases, information on employees, etc.

All this information is vital for the sustainability of the company, which is why it is necessary to protect it. In order to take the necessary measures, it is important to assess the sensitivity of your company's data by taking into account its strategic importance and the impact on the operation and image of your business in the event of theft, leak or fraud. Today, with the dematerialization of data and outsourced storage, cybercrime continues to increase, leaving business data increasingly vulnerable.

To better protect your information, you need to start by determining its strategic importance.

Are you a vitally important operator?

Some sectors of activity generate, process and store sensitive, confidential, and even critical data which, if they are victims of a malicious act (terrorism, sabotage, cyberattack), can have serious consequences on the defense and security of the entire country and its citizens.

This is the case for operators of vital importance (OIV). According to articles R. 1332-1 and R. 1332-2 of Defence code, these public or private organizations are vital for the functioning and survival of the Nation for two reasons:

• or they produce and distribute essential goods or services:
  • to the satisfaction of the essential needs for the lives of populations,
  • in the exercise of State authority,
  • to the functioning of the economy,
  • maintaining defense potential,
  • or to the security of the Nation;
• or they present a serious danger to the population.

Thus, the damage, unavailability or destruction of these organisms would seriously harm the functioning, security, defense or survival capacity of the Nation, or could harm the health or life of French citizens.

There are 249 OIVs whose list is kept confidential for reasons of national security. These are divided into twelve sectors of activity: civil, military and judicial activities of the State, health, military and judicial activities of the State, health, water management, food, energy, finance, transport, electronic communications, electronic communications, audiovisual and information, industry, audiovisual and information, industry, space and research.

Because of their particular status, OIVs must meet several obligations in terms of computer security:

• designating a delegate for defence and security;
• write an operator safety plan (PSO) that describes the operator's safety organization and policy;
• draw up a specific protection plan (PPP) for each of the points of vital importance identified.

If your company is one of the OIVs, you have been informed by the National Agency for Information System Security (ANSSI). You must then put in place strict specific measures to protect your critical data.

For more information on the safety of vital activities, see the pamphlet of the General Secretariat for Defence and National Security (SGDSN).

How do you determine the strategic importance of your data?

Whatever your sector of activity, your company collects and processes a large quantity of more or less vital data on a daily basis. A company's strategic data is crucial and essential to its operation, sustainability and security because it allows it to achieve an objective (increase its turnover, increase customer loyalty, develop a new product, etc.).

These strategic data fall into different categories:

• industrial data which include know-how, patents, the composition or manufacturing process of a product, the development of an innovation, etc.;
• Economic data such as the company's margin rate, the purchase price of raw materials, the purchase plan of a competing company, etc.;
• financial data which gather customer payment methods, various banking information, employee payslips, etc.;
• commercial data such as contracts with suppliers, customer lists, pricing policies, marketing strategies, etc.;
• personal data employees, customers and prospects, even suppliers and partners who range from social security numbers to home addresses to passport numbers, but also racial or ethnic origin, medical data, trade union membership, etc.

All this data is strategic for the company because, properly used, it will allow it to be efficient, efficient and competitive in its market.

For example, the data collected on the consumption and buying behaviors of customers and prospects is essential for the marketing department to develop strategies to seduce consumers so that they make the purchase, but also to better satisfy customers and retain them. As for industrial data, they allow the company to create new innovative products and thus stand out from its competitors.

Classify your data to better protect it

In order to best protect your strategic data, it is essential to classify it according to its value and strategic importance. To help you, figure out what the consequences would be if a confidential document were to be disclosed.

Here is a classification system with four levels:

• NC — Unclassified: this term refers to information that can flow freely within an organization and that does not require any particular protection.
• C1 — Internal use: this is the default level. It brings together information that can circulate freely within a given perimeter (company, service, etc.).
• C2 — Restricted distribution: the information classified here must be communicated only to the persons directly concerned and precisely identified. Their dissemination to the wrong interlocutors could affect the functioning of the company or hinder the smooth running of a project or mission.
• C3 — Secret: this level concerns confidential information whose disclosure to unauthorized persons may harm the strategic interests of the company, its security, or even its existence.

Finally, remember that to guarantee the security and confidentiality of your data, regardless of their nature, it is essential to entrust them to French or European service providers and providers, such as Wimi, which guarantee the sovereignty of your data by hosting them in France or Europe.

Also discover How to manage your organization's sensitive data.