The four variables
How long must this data stay confidential
The first variable: how many years a specific piece of data must remain secret, and why that number, not the algorithm, drives urgency.
6 min read · 5 min 56 sec film
What you'll be able to do
- Define confidentiality lifetime and explain why it is the variable that starts the reasoning chain.
- Give examples of data with short, medium, and long confidentiality lifetimes.
- Explain why a short-lived-data assumption should be justified, not assumed.
Lesson film
Watch: How long must this data stay confidential
The first variable is not about cryptography at all — it is a number someone in your organisation already knows, and almost nobody asks for.
5 min 56 sec · 8 scenes
5 min 56 sec, narrated by your browser's voice. Captions and a full transcript are below — nothing here needs sound.
The chain in this course starts with data, not with cryptography, and the order is deliberate.
With the player focused: Space plays or pauses, ← → seek ten seconds, Home restarts, M toggles narration.
Full transcript
1. Start with the data
2. How far it spreads
3. Why each number
4. Measured from today
5. Ask, do not assume
6. How to get the number
7. Lifetime alone is not risk
8. Takeaway
The written lesson
The reasoning chain in this course starts with data, not with cryptography. Before asking what protects a piece of data, ask how long that data actually needs to stay confidential. This is its confidentiality lifetime, and it varies by orders of magnitude depending on what the data is.
| Data class | Typical confidentiality lifetime | Why |
|---|---|---|
| Session analytics, ephemeral tokens | Hours to weeks | Value to an adversary decays almost immediately after the session ends. |
| Financial transaction records | Several years | Retention and dispute periods may differ from how long disclosure would harm the people or organization involved; confirm the latter with the data owner. |
| Health records, genomic data | Decades, sometimes the patient's lifetime | The sensitivity of the underlying fact does not expire on a schedule. |
| State, diplomatic, or long-range trade-secret data | Decades or longer | Value can persist well past the lifetime of the people or products involved. |
The number that matters is not how sensitive data feels today — it is how many years from today it must remain confidential. A record created five years ago with a twenty-year lifetime has fifteen years left, not twenty.
Confidentiality lifetime alone does not create HNDL exposure. Even an isolated system needs a stated threat model: insiders, removable media, backups, or later copies may create a capture path. If none is identified under the current model, record that limited finding and revisit it when the data flow or adversary assumptions change.
Retention is how long a system keeps a copy; confidentiality lifetime is how long disclosure would still matter. They can differ in either direction. A 30-minute access token might contain a lasting patient identifier or location history, while a retained record might become publicly releasable after a documented period. Classify the underlying information, consult its owner, and note the remaining lifetime from the date of assessment.
Primary reading and claim sources
Publication status checked on the date shown. Draft guidance can change.
- Cybersecurity in an Era with Quantum Computers: Will We Be Ready?Michele Mosca · Research paper · checked 2026-09-26
- SP 800-30, Revision 1: Guide for Conducting Risk AssessmentsNIST · Final guidance · checked 2026-09-26
Marking a lesson complete only updates this browser.