This state policy provides a data classification methodology to state agencies for the purpose of understanding and managing data and information systems with regard to their level of confidentiality and criticality. The accurate identification of data helps to ensure that the appropriate security controls are selected and implemented to protect data from unauthorized access or misuse.