# 42 Color-coded data domains (labels + IRM)

> v0.1.3 · role: Prevent · edition: Business Std+ (enforce: Ent Std+, Frontline Std+, Edu, Ent Essentials Plus) · [policy: #15 · #4](https://docs.google.com/spreadsheets/d/1nOztaPd1Y7eNeRSR_hdovYy-ncpx-bAx/edit?usp=sharing&ouid=115159875779023172526&rtpof=true&sd=true)

A small badged label — three or four values, colour-coded, unambiguous — is published to Drive and made visible to the whole organization or to the users and groups that must see it. The label is then what a DLP rule keys on: 'Restricted' blocks external sharing, and IRM strips download, copy and print from viewers and commenters. The colour is documentation; the rule attached to it is the control.

Documentation: [Get started as a classification labels admin](https://knowledge.workspace.google.com/admin/security/get-started-as-a-classification-labels-admin)

## Caveats

- A label is a colour until a DLP rule enforces it — and label-driven enforcement needs DLP for Drive — Enterprise Standard+, Frontline Standard+, Education editions or Enterprise Essentials Plus (Business Standard can create labels but not enforce on them).
- An unpublished label exists but does nothing — publishing it and scoping it to the OU is what makes it real.
- Labels do not apply retroactively — existing files stay unlabelled until someone or a script labels them, so pair this with the public-share cleanup (№11).
- IRM restricts download, copy and print; it is not DRM — printing from Preview mode is not blocked, and a screenshot, a photo of the screen or retyping defeats it.

## Setup steps

1. Create the classification taxonomy as a badged label — few values, unambiguous, colour-coded. Three or four values, not ten. — `Security › Access and data control › Label manager`

   - **Label** = 'Sensitivity' (badged)
   - **values** = Public / Internal / Confidential / Restricted

   docs: [Create classification labels for your organization](https://knowledge.workspace.google.com/admin/security/create-classification-labels-for-your-organization)

2. Publish the label and set its visibility — the entire organization (the default) or only certain users and groups. An unpublished label exists but does nothing. — `Security › Access and data control › Label manager`

   Status = Published; visible to entire organization

   docs: [Create classification labels for your organization](https://knowledge.workspace.google.com/admin/security/create-classification-labels-for-your-organization)

3. In the label's settings, tick the Applications checkboxes to make the label available in Drive; IRM is applied in the next step, as a DLP-rule action. — `Security › Access and data control › Label manager`

   - **Label applications** = Drive & Docs enabled

4. Attach a DLP rule to the label so that 'Restricted' actually blocks external sharing and applies IRM (the 'Disable download, print, and copy' rule action, where licensed) — the colour is documentation; the rule is the control. — `Security › Access and data control › Data protection`

   - **Condition** = Label 'Sensitivity' is 'Restricted'
   - **Action** = Block external sharing
   - **Severity** = High

   docs: [Create DLP for Drive rules and custom content detectors](https://knowledge.workspace.google.com/admin/security/create-dlp-for-drive-rules-and-custom-content-detectors) · [Prevent users from downloading, printing, or copying files](https://knowledge.workspace.google.com/admin/security/dlp-disable-download-print-copy)

## Ongoing maintenance

- **[requires a human]** Quarterly: review the label taxonomy against how documents are actually classified.

## How to verify

1. Open a labelled document as a test user and attempt the restricted action (download/print/copy) — IRM must refuse it.

## Settings screens

- Security > Access and data control > Label manager
  - console: https://admin.google.com/ac/dc/labels
  - screenshot: ../screenshots/admin.google.com/ac/dc/labels.png
- Apps > Google Workspace > Drive and Docs
  - console: https://admin.google.com/ac/managedsettings/55656082996
  - screenshot: ../screenshots/admin.google.com/ac/managedsettings/55656082996.png
- Security > Access and data control > Data protection (DLP rule keyed on the label)
  - console: https://admin.google.com/ac/dp
  - screenshot: ../screenshots/admin.google.com/ac/dp.png