Classifying government information must be based on a ‘harm test’. If your assessment shows that compromise of information would have adverse results, you must:
The Classification System uses Business Impact Levels (BILs) as a standard tool to assess the impact that might occur if its confidentiality, integrity or availability is compromised.
The BIL scale ranges from 1 (low) to 6 (catastrophic) impacts. The higher the impact, the stronger your security measures must be.
Although agencies should apply their own judgement in every case, the likely relationship between the harm test and classification level is shown in the table below.
To assess the harm, use the BILs matrix and the following guide to identify and articulate the harm.
When assessing the harm of compromise ask yourself the following two questions:
The Business Impact Levels matrix considers impacts in four categories: Personal; Organisational; New Zealand domestic; and, Defence, Security and International Relations.
Identify which categories apply for the information in question.
Note: When classifying information, the information set may touch on multiple categories. The harm test should cover all relevant categories for the information set(s) in question.
| Category | Identifying Questions |
| Personal Impact | If the information was compromised, would it have any impact on a person’s rights, freedoms, health or safety under New Zealand law e.g.,
|
| Organisational Impact | If this information was compromised would it affect or harm an organisation’s operations, finances, reputation, or obligations under New Zealand law? |
| National interests: New Zealand Domestic Impact | If this information was compromised would it have any impact on New Zealand national services, national infrastructure, economy, or the maintenance of law and order? |
| National interests: Defence, Security and International Relations Impact | If this information was compromised would it have any impact on New Zealand’s defence, security, or international relations or on friendly nations? |
Table 3: Business Impact Levels Matrix Impact Categories
USER TIP: When assessing harm, it can be useful to search if the information is already publicly available. If already available publicly, then compromise of the information is likely to have low impact.
For each of the impact categories you identified in Q1, assess the harm level against the BILs Matrix.
USER TIP: When authoring or preparing information with information at different classification levels, consider use of paragraph marking to clearly identify the classification of each section of a document, email, or dataset. This articulates the sections that have the highest classification level and enable more appropriate information sharing with different audiences.
When information is aggregated together into a collection (e.g. within a document, database, or system), you must use (at minimum) the highest classification level of any paragraph marking for the entire information collection. Note that aggregation of classified information may require increased protection as the harm and impact of its compromise may be higher.
The BILs use a continuum of increasing impact from (1) Low to (6) Catastrophic. The judgement that users must make when assessing harm can be subjective. The Classification Tool below is provided to help distinguish these levels and assess the appropriate business impact level.
If the information would not cause harm to New Zealand’s national interests, then begin your assessment at Policy and Privacy 3 High Impact.
For experienced classifiers, use the Classification flowchart [PDF, 76 KB] to quickly help you assess harm and impact and classify information.
The rest of this section provides more guidance, scenarios, and considerations to enable you to make an informed and appropriate classification decision.