In a standard data classification framework, a data handling matrix applies the same security and handling requirements to nonsensitive data as it does to personally identifiable information (PII).

### Why this is right The matrix gives no specific requirements for nonsensitive data, while it specifies encryption, approval, security, or destruction guidance for personally identifiable information and intellectual property. ### The concept A handling matrix distinguishes data categories rather than applying one rule to every kind of information. Nonsensitive data has no handling rule specified in this particular matrix. That does not establish that an organization has no other policies for it; it only describes what the provided material states. ### The other options - **True**: This would incorrectly apply the sensitive-data rules to the matrix's nonsensitive category. ### Terms - **Handling matrix**: A table that links data categories and uses to required protections. ### Remember Use the requirements shown for the relevant data category; do not transfer them automatically to another category.