High-water mark

The high-water mark principle sets the classification of a container at the level of the most sensitive thing inside it. A laptop or a document holding a mix of public and confidential information is protected as confidential, because its controls have to be strong enough for its most sensitive content. Asset classification commonly works this way: the asset inherits its level from the data it stores, processes or transmits. US federal practice uses the same idea. Under FIPS 199, an information system’s security category reflects the highest impact values among the information types it handles, and FIPS 200 names the high-water mark concept when that category is used to select a control baseline.

The cost of the rule is over-protection. Placing one sensitive record on a general-purpose system raises the level of the whole system, which is one reason organisations keep data of different sensitivity apart rather than mixing it. Portion marking applies the rule inside a document: each section carries its own mark, while the overall banner shows the highest level present.

Exam relevance: a scenario may describe an asset holding data at several levels and ask how the asset should be classified. Candidates are expected to take the highest level present, and to recognise separating data by sensitivity as the way to avoid raising a system’s level unnecessarily.