Behavioral-Context Sensitive Data (BCSD): A Formal Classification Framework for Interaction-Level Risk

This framework paper introduces Behavioral-Context Sensitive Data (BCSD) as a formal data classification category and develops the governance instruments required to address the threat it represents. It accompanies the Soft Armor Labs technical note on the Canvas breach (DOI: 10.5281/zenodo.20098418), which established the motivating argument: that longitudinal, role-anchored communication data constitutes a distinct asset class whose exploitation enables interaction-level impersonation rather than simple identification. This paper provides the operational layer that the motivating argument requires. It defines BCSD with five formal criteria, introduces a four-tier classification schema (BCSD-0 through BCSD-3), formalizes the Behavioral-Context Compromise (BCC) threat pipeline, maps required controls against NIST CSF v2.0 and ISO/IEC 27001, and specifies five concrete institutional obligations. The framework is designed to be regulator-ready: it slots alongside existing sensitive data gradations without requiring wholesale replacement of current classification models. BCSD is not merely descriptive. It is operational—it directly enables interaction-level impersonation rather than simple identification, and it requires governance instruments calibrated to that capability.