Servers storing or processing information belonging to more than one classification must meet the requirements associated with the highest classification. If you aren't able to identify whether or not a server may have HRCI, apply the level 4 controls.
See also: Level 2, Level 3, Level 4, Work with Confidential Information, Manage All Servers, SA13, Servers A