An embodiment of the invention provides a method for security classification applying social norming. More specifically, content is received from a user via an interface; and, a data repository connected to the interface stores the content. A portal connected to the data repository identifies an attempt to access the content from a non-user. A program processor connected to the portal determines whether the content includes a security classification. When the content does not include a security classification, a communications module connected to the program processor sends an alert to the user. The alert includes a request to assign a security classification to the content. When the content includes a security classification, the communications module sends a message to the user, wherein the message includes a request to verify the security classification.