# Data Classification for AI and File Sharing Micro-Course

A free, reviewable cybersecurity awareness course package for teaching employees how to classify work information before sharing it in collaboration tools, email, file drives, or AI systems.

Use this package as a starter asset. Review and adapt it against your own data classification policy, approved systems, AI-use rules, reporting channels, role expectations, and legal/compliance requirements before assigning it to learners.

## Course overview

**Audience:** Employees, managers, client-facing teams, GRC teams, security awareness leads, MSP/vCISO clients, and L&D teams supporting data-handling refreshers.

**Duration:** 6 to 8 minutes.

**Format:** Short lesson, three workplace scenarios, three quiz questions with teaching feedback, remediation note, LMS packaging guidance, and a Content Studio by Jericho prompt.

**Learning objective:** Learners will be able to pause before sharing work information, identify whether the information may be public, internal, confidential, regulated, customer-owned, controlled, or security-sensitive, and use the approved sharing or escalation path.

**Not a promise:** This course does not guarantee compliance, prevent data loss, or prove secure behavior. It supports awareness, policy communication, and reviewed training workflows when adapted and approved by the organization.

## Lesson script

Data classification is not paperwork for paperwork’s sake. It is the habit of asking, “What kind of information is this, and where is it allowed to go?”

That question now shows up everywhere: email, chat, shared drives, screenshots, vendor portals, customer tickets, AI tools, spreadsheets, meeting notes, source code, and documents copied from one system to another. The risky moment is often not dramatic. It is a helpful employee trying to move faster.

A strong rule of thumb is simple: before sharing work information, check three things.

1. **The data:** What is in the content? Customer information, employee information, contract details, controlled information, confidential business plans, credentials, logs, source code, security findings, or regulated data may need special handling.
2. **The destination:** Is the system approved for that information type? Email, consumer file sharing, personal devices, public AI tools, and open links may not be appropriate.
3. **The purpose:** Does the recipient need this information for approved work, and is the amount of information limited to what they need?

Classification helps employees choose the right path. Public information can usually be shared broadly after normal review. Internal information stays inside approved company systems. Confidential information may need restricted access. Regulated, customer-owned, controlled, or security-sensitive information may require specific systems, approvals, markings, retention rules, or review owners.

The point is not to make every employee a compliance attorney. The point is to give people a practical pause button before they move information somewhere it does not belong.

AI tools make this habit even more important. A prompt can feel private because it is typed into a chat box, but the content may still leave an approved environment if the tool is not approved for that data type. Do not paste customer records, employee details, contracts, CUI, proprietary code, security findings, credentials, incident details, or confidential notes into an unapproved AI tool. If you are unsure, use the approved AI workflow or ask the data owner.

File sharing has the same problem. A link can feel easier than a ticket. A personal drive can feel faster than the approved repository. A public folder can feel convenient during a deadline. But convenience does not decide whether the sharing path is safe. Policy, approved systems, recipient need, and review requirements decide that.

When the classification is unclear, the best next step is usually not to guess. Pause. Check the policy. Use the approved system. Ask the owner. Escalate through the reporting or help channel. If a mistake has already happened, report it quickly so the team can contain and correct it.

The practical habit is this: before you email, upload, paste, summarize, screenshot, or share work information, classify it first and use the approved path.

## Scenario 1: The AI summary shortcut

A project manager wants to paste customer meeting notes into a public AI tool to create a summary for leadership. The notes include customer names, renewal concerns, contract details, and screenshots from a support ticket.

**Coaching point:** Do not paste the notes into an unapproved AI tool. Check the approved AI policy, remove or minimize sensitive content only if policy allows it, and use the approved workflow for customer or contract information.

**Teaching line:** A useful AI shortcut still has to respect data classification and approved-tool rules.

## Scenario 2: The open file-sharing link

A team member creates an open share link for a spreadsheet so an external partner can review a few rows. The spreadsheet also includes employee names, project notes, and internal status comments that the partner does not need.

**Coaching point:** Use the approved sharing system, limit access to named recipients where required, remove information the recipient does not need, and confirm whether the spreadsheet contains confidential, personal, customer, controlled, or regulated information before sharing.

**Teaching line:** Share the minimum needed information through the approved path.

## Scenario 3: The screenshot in chat

An employee posts a screenshot in a team chat to get help quickly. The screenshot includes a customer email address, an error message, and an API token visible in the corner of the screen.

**Coaching point:** Do not share secrets or unnecessary sensitive details in chat. Redact tokens and sensitive information before sharing, use the approved support or incident path, and report exposed credentials or tokens according to the security process.

**Teaching line:** Screenshots are data too.

## Quiz questions

### Question 1

A colleague asks if they can paste customer support tickets into an unapproved AI tool to summarize trends. What is the best response?

A. Yes, as long as the output is helpful.
B. Yes, if they remove the customer’s first name.
C. No. Check the approved AI policy and use an approved workflow for customer information.
D. No AI tools should ever be used for work.

**Correct answer:** C

**Teaching feedback:** Customer information and support content may be sensitive. Use approved tools and workflows, and do not rely on partial redaction unless policy allows it.

### Question 2

You need to share a spreadsheet with an external partner, but it includes extra internal notes and employee details. What should you do first?

A. Send the whole spreadsheet because the partner is trusted.
B. Create a public link so access is easy.
C. Remove unnecessary information, confirm the classification, and use the approved sharing method.
D. Copy the spreadsheet to a personal drive and share it from there.

**Correct answer:** C

**Teaching feedback:** Sharing should be limited to the information needed for the approved purpose, through the approved system, with the right access controls.

### Question 3

A screenshot for troubleshooting includes an API token. What should happen before it is shared?

A. Share it quickly so support can fix the issue.
B. Crop or redact the token, use the approved support path, and report exposure if the token was already shared.
C. Post it in a larger team channel to get more help.
D. Save it locally and send it from a personal email account.

**Correct answer:** B

**Teaching feedback:** Screenshots can expose secrets, customer data, or internal details. Redact sensitive content and follow the approved support or incident process.

## Remediation note

If a learner misses one or more questions, assign a short follow-up: identify one kind of information they handle at work, name its approved storage or sharing location, and explain what they would do if they were unsure whether it could be shared with an AI tool or external recipient.

## LMS packaging guidance

- **SCORM/xAPI objective:** Learner can classify common work information before sharing or using AI tools.
- **Completion rule:** Complete lesson and pass quiz with 80% or higher.
- **Estimated seat time:** 6 to 8 minutes.
- **Accessibility notes:** Provide captions/transcript for any video version. Avoid color-only classification cues. Include plain-language examples for each classification level used by your organization.
- **Review owners:** Security, GRC/compliance, privacy/legal where needed, AI governance, data owner, L&D, and the business process owner.
- **Refresh triggers:** Data classification policy update, AI tool approval changes, new file-sharing platform, data-handling incident, customer contract change, assessment finding, or recurring support-ticket pattern.

## Content Studio by Jericho prompt

Use this prompt inside Content Studio by Jericho after replacing bracketed placeholders:

> Create a 6 to 8 minute cybersecurity awareness micro-course for [AUDIENCE] on classifying work information before sharing it in email, file-sharing tools, collaboration apps, screenshots, or AI systems. Use these classification categories: [PUBLIC], [INTERNAL], [CONFIDENTIAL], [REGULATED/CONTROLLED], [CUSTOMER-OWNED], and [SECURITY-SENSITIVE]. Include one AI prompt scenario, one external file-sharing scenario, one screenshot or support-ticket scenario, three quiz questions with teaching feedback, a remediation note, captions/transcript guidance, LMS-ready export notes, and review assumptions for security, GRC/compliance, privacy/legal, AI governance, L&D, and the business owner. Use proof-safe language. Do not claim the course guarantees compliance, prevents data loss, or proves behavior change.

## Review boundary

Human review is required before publishing. Security should confirm risk framing, GRC/compliance should confirm policy fit, AI governance should confirm approved-tool language, privacy/legal should inspect regulated or contractual references, data owners should confirm examples and approved systems, and L&D should check learner clarity, accessibility, and quiz feedback.

Use this as a starter asset, not legal advice, a compliance guarantee, proof of control effectiveness, or a promise of outcomes.