1

I am working on a data governance enhancement at my work. My current task is to use ssms classify data feature. However, I want to customize the "sensitivity level" for my work (government) we have hipaa, cjis, NFIRS, NFPA, CISSP commercial classification and a few others related to the legal process. Does anyone know how to customize the list?

Currently, SSMS has: public, confidential, confidential - GDPR, highly confidential, highly confidential - GDPR, and [n/a].

Thanks for your help

2

I haven't yet found a way to customize the dropdown list in the GUI, but you can use the Add Sensitivity Classification statement (only in Azure SQL and SQL 2019 so far -- Ugh! Sorry.) to apply any label you want to classify a column.

See this Microsoft documentation for details on the Add Sensitivity Classification statement. But here are the basics:

ADD SENSITIVITY CLASSIFICATION TO
<object_name> [, ...n ]
WITH ( <sensitivity_label_option> [, ...n ] )     

<object_name> ::=
{
    [schema_name.]table_name.column_name
}

<sensitivity_label_option> ::=  
{   
    LABEL = string |
    LABEL_ID = guidOrString |
    INFORMATION_TYPE = string |
    INFORMATION_TYPE_ID = guidOrString  
}

Also see this Aaron Bertrand article at MSSQLTips.com.

That being said, even though you have to deal with HIPAA, CJIS, NFIRS, NFPA, and CISSP, and they might not use exactly the same terms as each other, you should still be able to map the sensitivities to the built-in labels. Customizing the labels might work for now, but you'll have to do extra work to maintain that customization, making sure it is consistent across tables, database, and instances, and documenting it well.

I recommend you work with your auditing and compliance folks to reach a mutual understanding of what each sensitivity label means to your organization, and how to map that to the various regulatory expectations.

  • Thanks, good suggestions. I with I have am audit and compliance folks, to get this done it will be just me. :/ You suggestion make sense to combine them into one. But reporting might be harder. I will try the code you suggested and see how it works. Again thanks. – Joe McBrat Apr 2 at 23:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.