3 ms·

Is "secret" not one of the classifications for internal documents? "top secret", "secret", "confidential", "restricted". While this classification is usually us

by 0x006A 7y ago

Is "secret" not one of the classifications for internal documents? "top secret", "secret", "confidential", "restricted". While this classification is usually used to classify access to documents of the state, it could also apply to internal documents in large organizations.

necroforest 7y ago
no
ajdlinux 7y ago
I'm not aware of any private sector companies that have more than 2-3 formal "classification" markings, and they're usually more like "internal use only" and "confidential" rather than "secret". For particularly sensitive documents there would of course be additional restrictions, but I'd be surprised if there were companies using the marking "top secret" for that purpose...
- rietta 7y ago
  I have seen companies with 5. Along the lines of: 1. Public: Public information 2. Internal Use: Confidential business information 3. Confidential: Information that customers consider confidential 4. Sensitive: Personal and Private Information (PII), information that THE LAW considers confidential 5. Highly Sensitive: Encryption keys, server secrets, staff/admin passwords This list is from a blog I wrote at https://rietta.com/blog/commercial-information-classifications/ https://rietta.com/blog/commercial-information-classificatio.... It was adapted from something I originally saw while a student at Georgia Tech. I've consulted with companies that separately developed a substantially similar 5 point list.
  - jefftk 7y ago
    Yes. Categories I've encountered at the big tech company I work at include: * Public * Company confidential (most things) * Need to know (only finance people can see some kinds of financials, only people working on a service can see it's logs) * Legal stuff * Personnel stuff * Highly valuable IP (spam detection algorithms etc)
bertil 7y ago
It can be but I’d be surprised if that document had anything like it. Very few things are confidential internally at Facebook. Compensation, seniority level and review are the most common “Confidential” category but they are typically marked as “personal and confidential”. A few things are permission-access-controlled (think things involving the Police where rules of evidence apply) but I don’t remember if they had a name; “Talk to legal” was the short-hand. Source: I used to work at Facebook & I know Tom C. personally. I’ve written similar documents four years ago. There were publicly visible internally. Few people really cared outside of senior Product people.
- paulie_a 7y ago
  How can seniority level be secret?
  - jefftk 7y ago
    "seniority level" an in "what level have you been promoted to". At Google you don't have to disclose your level, but most people do and most of my coworkers know I'm L5. At Facebook my understanding is they've tried to build a culture where people don't know each other's levels, to focus more on "what can you do" instead of "what does management think you can do".
    - wolco 7y ago
      Then why have different levels at all and just pay more or less? Why hide someone's position/level.. why even have levels? Is this a shield for management.. you shouldn't know Jim is more valuable.. easier to pull the wool over employee eyes?
      - slowmovintarget 7y ago
        You have levels to guide HR in making compensation decisions relative to the rest of the market. For example, Google might set their target at 105% of the top range of the market in order to retain the best employees. 105% of a fresh graduate's salary is very different from the same rate for a top-of-field industry recognized veteran. Even in those cases, that's a guide so exceptions are made as merited. And no, I don't work at Google :)

by 0x006A 7y ago

necroforest 7y ago

ajdlinux 7y ago

I'm not aware of any private sector companies that have more than 2-3 formal "classification" markings, and they're usually more like "internal use only" and "confidential" rather than "secret". For particularly sensitive documents there would of course be additional restrictions, but I'd be surprised if there were companies using the marking "top secret" for that purpose...

rietta 7y ago
I have seen companies with 5. Along the lines of: 1. Public: Public information 2. Internal Use: Confidential business information 3. Confidential: Information that customers consider confidential 4. Sensitive: Personal and Private Information (PII), information that THE LAW considers confidential 5. Highly Sensitive: Encryption keys, server secrets, staff/admin passwords This list is from a blog I wrote at https://rietta.com/blog/commercial-information-classifications/ https://rietta.com/blog/commercial-information-classificatio.... It was adapted from something I originally saw while a student at Georgia Tech. I've consulted with companies that separately developed a substantially similar 5 point list.
- jefftk 7y ago
  Yes. Categories I've encountered at the big tech company I work at include: * Public * Company confidential (most things) * Need to know (only finance people can see some kinds of financials, only people working on a service can see it's logs) * Legal stuff * Personnel stuff * Highly valuable IP (spam detection algorithms etc)

bertil 7y ago

It can be but I’d be surprised if that document had anything like it. Very few things are confidential internally at Facebook. Compensation, seniority level and review are the most common “Confidential” category but they are typically marked as “personal and confidential”. A few things are permission-access-controlled (think things involving the Police where rules of evidence apply) but I don’t remember if they had a name; “Talk to legal” was the short-hand. Source: I used to work at Facebook & I know Tom C. personally. I’ve written similar documents four years ago. There were publicly visible internally. Few people really cared outside of senior Product people.

paulie_a 7y ago
How can seniority level be secret?
- jefftk 7y ago
  "seniority level" an in "what level have you been promoted to". At Google you don't have to disclose your level, but most people do and most of my coworkers know I'm L5. At Facebook my understanding is they've tried to build a culture where people don't know each other's levels, to focus more on "what can you do" instead of "what does management think you can do".
  - wolco 7y ago
    Then why have different levels at all and just pay more or less? Why hide someone's position/level.. why even have levels? Is this a shield for management.. you shouldn't know Jim is more valuable.. easier to pull the wool over employee eyes?
    - slowmovintarget 7y ago
      You have levels to guide HR in making compensation decisions relative to the rest of the market. For example, Google might set their target at 105% of the top range of the market in order to retain the best employees. 105% of a fresh graduate's salary is very different from the same rate for a top-of-field industry recognized veteran. Even in those cases, that's a guide so exceptions are made as merited. And no, I don't work at Google :)