The agency published public, internal, and confidential labels, but systems still treat every field the same. What is missing?
Select an answer to reveal the explanation.
Short Explanation
Having nice color stickers in the drawer does nothing if nobody puts them on the boxes. Classification only helps when it is actually tagged onto the fields and datasets your systems protect.
Full Explanation
Publishing public, internal, and confidential labels is only the start; governance must apply the classification scheme to data assets and fields so technical and procedural controls can enforce it in catalogs, access paths, and sharing workflows. Labels that live only as posters leave systems treating every field the same and leave resident data under- or over-protected. Replacing classification with a single “sensitive” banner on the intranet home page fails because a generic banner cannot drive field-level controls or differentiated handling. Delaying classification until every legacy system is replaced fails by postponing protective practice indefinitely while civic systems continue to run. Storing labels only in slide decks because catalogs supposedly cannot hold them fails as a documentation theater problem—modern catalogs and inventories can and should carry classification metadata. Exam caveat: classification without application is not control; exams expect linkage from scheme to assets to enforcement. Operational check: map labels onto critical datasets and fields, verify access and sharing rules reference those labels, and sample whether confidential resident attributes are actually restricted. Record classification coverage as a governance health metric so the city can show labels are operational, not decorative.