We currently run a very large Sharepoint 2010 collaboration platform for our company (50,000 employees +), and we've come to the point where we need to help support our security team in letting employees "tag" their documents.
We have a few default security classifications we use internally - like "top secret", "open", "confidential", etc. Any one document must be given one and only one classification; I.e a document can't be both open and confidential. Every document must have a confidentiality level too- by default, it's just "confidential".
We want to roll out a solution whereby every file that is uploaded by an end user to our farm - no matter which site, library or document set it sits in, is given a security classification field, which defaults to "confidential". The user should have the option of choosing a new confidentiality, by editing the properties of the file - just like if they were to edit the name or owner, etc.
We're a little stuck as to the best approach to do this. It's been suggested we could use information management policies, workflows, or even creating a new document type that everything gets assigned to. However, we can't find any guidance anywhere as to the best practice, recommended way to do this.
Does anyone have any good suggestions for how to approach this? Ideally we want to stay as close as possible to the default / recommended behaviour in Sharepoint 2010 as possible! Any views or thoughts would be greatly appreciated :)