A set of criteria that defines the sensitivity of information and the appropriate levels of protection that must be applied.