Australia's new Industry Data Classification Framework explained for business

What it is

Comprehensive industry guidance for identifying, assessing, classifying and communicating the value of data holdings. It covers electronic data, the systems and devices that carry it, and can be applied to physical copies as well.

Who built it

The Department of Home Affairs (Technology Security Policy Branch) in partnership with CSIRO's Data61, drawing on research and consultation with industry across Australia.

Who it is for

Any Australian organisation, from a small business to a large enterprise. Home Affairs describes it as designed to work whether you are just starting your data security journey or already have mature handling practices.

What it is not

It is not legislation, not a certification, and not legal advice. Home Affairs is explicit that publication does not constitute endorsement for specific circumstances and that users must make their own determination about appropriate use.

The stated aims

Provide guidance on how to identify, assess, classify and communicate the value of data. Give industry a common classification language. Enable organisations to assess data risk and apply controls. Support confidentiality, integrity and availability requirements together, not confidentiality alone.

Where it draws from

Existing classification systems, including the Protective Security Policy Framework (PSPF) that applies to Australian Government entities. The intent is to promote common approaches between government and industry rather than invent a parallel system.

What Horizon 2 means for you

Home Affairs will work with industry on adoption through 2026 to 2028. In practice that is where a voluntary framework becomes an expectation in supply chains, tenders and cyber insurance proposal forms.

Data as an economic asset

The release frames data as a source of growth for the Australian economy. The framework is pitched as much at enabling confident data sharing between organisations as it is at protection.

Module 1: Introduction

Purpose, key terms, expectations of use, labelling and marking (both visual and metadata), and a code of conduct for organisations that adopt the framework.

Module 2: Risk Assessment

For organisations that need guidance on how to conduct a risk assessment across their data holdings. Understanding the data, the consequences of an adverse event, impact rating, and the kinds of adverse events to plan for.

Module 3: Data Security Levels (DSL)

The core of the IDCF. A system to classify data holdings from DSL-0 to DSL-5+ and communicate the required protection in a universal way to every user and recipient.

Module 4: Markers

An optional secondary system to communicate extra information or risks attached to a data holding, over and above its DSL. Integrated, adopted and user-defined markers with a consistent prefix format.

The appendices do the heavy lifting

Glossary, consequences questionnaire, impact rating worksheet, adverse event identification questionnaire, and a Statement of System Security template. These are the pieces most SMBs will actually fill in.

Understand your data

Three lenses: data type (what it is and who it is about), data scale (how much of it and how many people it concerns), and data currency or timeliness (whether it loses or gains sensitivity over time).

Consequences of an adverse event

The framework groups consequences into harm to individuals, harm to organisational assets, harm to organisational operations, and harm to the organisation in general. Appendix B is a consequences questionnaire built around those four.

Impact assessment

Consequences are rated on an impact scale using an impact rating table. Appendix C is the worksheet: understand your data, work through consequences and impacts, then summarise a single impact rating.

Understanding adverse events

The module defines what an adverse event is, catalogues the different kinds, and shows them in practice. Appendix D is a questionnaire for identifying the adverse events that are realistic for your holdings.

Where this meets your existing work

If you have already done a Privacy Act personal information inventory or an SMB1001 asset register, most of the 'understand your data' step is done. The IDCF adds the consequence and impact discipline on top.

Three event types

The DSL module models a physical event, cyber events, and an authorised person event (misuse by someone who legitimately has access). Each level is defined by what it is expected to withstand across those three.

Selecting a DSL

The impact rating from the Risk Assessment module drives the level. The framework also warns about the risks of streamlined classification, where an organisation shortcuts the assessment and labels everything the same.

Appropriate systems and environments

Each level carries expectations about the systems allowed to store and process the data. The module maps these to related cyber security frameworks and standards so that existing Essential Eight, SMB1001 or ISO 27001 work counts toward the evidence.

Absence of a DSL label

The framework addresses unlabelled data explicitly. Not labelling something is a decision with consequences, and recipients need a rule for how to treat data that arrives without a level.

Rules versus guidance

The module separates rules (what you must do to claim IDCF alignment at a level) from guidance (communication and movement of data, classifying containers, data for publication, assessing systems).

Statement of System Security

Appendix E is a template for documenting what a system is approved to hold and why. It is the artefact you hand to a client, auditor or insurer to show the level a system supports.

Three marker categories

Integrated markers (defined within the framework), adopted markers (taken from another recognised scheme), and user-defined markers (created by your organisation for your own needs). All follow a consistent format and prefix convention.

Visual labelling

How the DSL and any markers appear on the document, email or system so a human reader knows how to handle it.

Metadata labelling

How the same classification is carried in a machine-readable form so DLP, encryption and access controls can enforce it automatically. This is where the framework becomes operational rather than a policy on a shelf.

Code of conduct

Organisations that adopt the IDCF agree to general conduct expectations around honest classification and respecting the labels applied by others. The framework only works if a DSL means the same thing when it leaves your building.

How Real Bytes maps it

Our practical four-tier scheme for SMBs maps cleanly onto DSL levels and deploys as Purview sensitivity labels, auto-labelling and DLP. The IDCF gives that work a nationally recognised vocabulary.