Stop Treating Security Classification Guides Like Static Documents

Operationalizing SCGs for Zero Trust data decisions

Every national security organization has some version of the same data sharing problem: the security guidance exists, the data exists, the mission need exists, but the control path between them is manual. Security Classification Guides (SCG) explain what makes information sensitive, how it should be marked, and when combinations of facts become more sensitive than the individual parts. Yet those guides usually sit in documents while mission data moves through file shares, databases, data lakes, SaaS platforms, cross domain workflows, and now AI pipelines. This disconnect, between the releasability of mission critical data and operational effectiveness of our coalition partners, impacts the commander’s decision-making processes and impacts the effectiveness of the joint and coalition force.

Implementing Zero Trust for data access greatly enhances the commander’s ability to rapidly integrate the entire contingency force.  Zero Trust makes information access decisions based on the user, device, application, data, and context. Within the data pillar, zero trust enables machine readable classification context and through the policy engine data releasability is automated to unlock guidance stored in PDF files. Through Zero Trust the commander can keep pace with conditions on the battlefield.

The Real Problem Is Aggregation

The hardest classification problem is not always an obvious code word or a visible marking. Often the problem is aggregation. One data element may be acceptable. Another may be acceptable. Together, they may reveal a more sensitive capability, source, method, operational plan, or partner restriction. When teams cannot see that combination at scale, they usually pick one of two bad options: miss the risk or mark everything high.

The Strava incident from 2018 is a public example of exactly this problem. Strava published a global heatmap of fitness tracking data. Individual workout routes were harmless on their own, but the aggregated picture revealed the locations, layouts, and activity patterns of military bases and intelligence facilities in conflict zones. None of the underlying data was classified. The combination was operationally sensitive. That kind of aggregation risk is what SCGs are designed to address, and catching it manually at scale is nearly impossible. 

Over classification feels safer, but it carries a mission cost. It slows coalition data sharing, makes deployed operations harder, increases staff workload with review backlogs, and limits the ability to use data for AI, analytics, and command decision making. Under classification is worse: it creates spillage and unauthorized disclosure risk. The right answer is not more manual review. The right answer is to operationalize the security classification guidance.

What It Means to Operationalize an SCG

Operationalizing an SCG means translating human readable guidance into classifiers and policy context feeding the Zero Trust policy engine. The guide remains authoritative. Human classification authorities still own the rules. But the operational system can now find matching data, explain why it matched, show who or what has access, and recommend or execute the appropriate control.

1. Break the SCG into atomic rules, aggregation conditions, handling caveats, releasability constraints, and examples.
2. Build classifiers from those rules using exact terms, patterns, dictionaries, entity recognition, machine learning, and semantic examples.
3. Scan mission data repositories such as SMB/NFS shares, NetApp, S3 buckets, OneDrive, SharePoint, application databases, data lakes, and collaboration stores.
4. Map matched data to users, groups, service accounts, APIs, applications, and AI agents with effective access.
5. Implement through the policy engine to bind the classification result to policy decisions: allow, deny, route to guard review, remove access, quarantine, alert, or apply an approved enterprise label.

A Concrete Example

Imagine a combatant command wants to share operational reporting with a coalition partner. The SCG says that a platform name alone is lower risk, a general mission area alone is lower risk, and a capability value alone is lower risk. But the combination of platform, location, and capability crosses a threshold and requires a higher marking or a NOFORN handling caveat.

A static process depends on a human reviewer catching that combination every time. An operationalized process creates a classifier that detects the combination across repositories. When it finds a match, it records the matched SCG rule, highlights the relevant excerpt, assigns confidence, and checks the access graph. If the file is sitting in an open share or queued for transfer to a coalition portal, the workflow can stop the transfer, route the file to disclosure review, or remove unauthorized access.

The point is not to remove humans from classification. The point is to make humans faster, better informed, less dependent on heroic manual review, and able to keep pace with the commander’s intent.

Where Zscaler DSPM Fits

Zscaler DSPM as part of the Zero Trust platform can close the operational gap because commanders now answer questions such as: what sensitive data do I have, where is it, who or what has access, how is it being used, and what action should I take?

• Discovery and classification can identify sensitive data across cloud, SaaS, structured, unstructured, and customer hosted data stores.
• Custom and AI/ML classifiers can represent mission specific SCG concepts, including aggregation conditions. When the SCG says that a platform name, a location, and a capability value are each acceptable alone but sensitive in combination, that rule can be encoded as a classifier. DSPM then scans repositories to find where those combinations exist, so the aggregation risk described above is caught at machine scale rather than left to manual review.
• Access graphing connects sensitive data, including matched aggregations, to users, groups, service accounts, APIs, and AI agents. When a sensitive combination is found, the access graph shows exactly who or what can reach it.
• Activity context helps prioritize actual mission risk instead of treating every permission as equal.
• Guided remediation turns findings into action: remove broad access, open an ITSM ticket, alert the owner, route to guard review, or integrate with approved labeling workflows.

A Better Zero Trust Data Story

For Department of War and intelligence adjacent missions, this should become a central Zero Trust data pillar story: do not merely discover sensitive data; convert classification guidance into operational control. That is how agencies reduce over classification, speed coalition sharing, support commanders, and protect mission data as it moves into AI and analytics workflows.

The practical starting point is small. Pick one SCG, one mission repository, one access problem, and one policy outcome. For example: identify all files matching a specific compartment rule on a file share, map who can access them, remove broad access, and route edge cases to a classification officer. Then expand to databases, data lakes, cross-domain workflows, and AI pipelines.

The future state is not a world where every document is reviewed by hand before it can move. The future state is a data environment where classification guidance is machine actionable, access decisions are evidence based, and commanders can share the right data with the right partners at the speed of mission.

If your organization is working to operationalize classification guidance as part of a Zero Trust data strategy, contact your Zscaler sales representative to learn how DSPM can support your mission.