ISO 27001 A.5.12 - Classification of Information

Requirement

“Information shall be classified according to the information security needs of the organization based on confidentiality, integrity, availability and relevant interested party requirements.”

Plain-language meaning

Information must be grouped by protection need so people know how carefully to handle it.

Classification is not decoration. It is a decision about required protection based on confidentiality, integrity, availability, business need, legal obligations, contractual commitments, and interested-party requirements.

Why this matters

Different information needs different treatment. A public brochure, payroll record, medical record, source code repository, and critical recovery procedure should not all be handled the same way.

Classification helps the organization decide:

• who can access the information;
• how it should be stored;
• how it may be shared;
• whether it needs encryption;
• how it should be backed up;
• how long it should be retained;
• how it should be disposed of;
• what labels or handling rules apply.

Implementation guidance

1. Define the classification scheme

The organization should write down the classification scheme and make it available to people who create, handle, approve, or receive information.

The scheme should be simple enough to use consistently.

Too many levels create confusion. Too few levels force over-classification or under-classification.

Example scheme:

Use the organization’s real labels. There is no universal ISO classification label set.

2. Decide default classification rules

The organization should decide whether every information item must be actively classified or whether a default applies.

Examples:

• all information defaults to Internal unless marked otherwise;
• only sensitive information must be actively labelled;
• client information follows the client’s classification scheme;
• systems may be approved to process only certain classifications.

If the default is unclear, staff will guess.

3. Assign classification responsibility

The asset owner should normally be responsible for classification.

The owner should:

• understand business value;
• understand legal and contractual requirements;
• classify the asset;
• approve handling rules;
• ensure classification is reviewed;
• update classification when sensitivity changes.

This connects to A.5.9 Inventory of Information and Other Associated Assets.

4. Define handling requirements for each classification

Classification without handling rules is useless.

For each classification, define:

• access control expectations;
• storage locations;
• transmission rules;
• printing rules;
• sharing and release approval;
• retention;
• disposal;
• backup and recovery expectations;
• labelling requirements.

5. Review and change classifications

Information sensitivity changes.

Examples:

• financial results become public after announcement;
• a project becomes less sensitive after launch;
• records pass retention deadlines;
• a client changes handling requirements;
• legal or regulatory obligations change.

The scheme should allow review, upgrade, downgrade, expiry, or removal of classification where appropriate.

Audit guidance

Auditors should verify that the organization has a classification scheme, that it is implemented, and that it supports appropriate protection of in-scope information.

Audit tests:

• review the classification scheme;
• check whether definitions are clear and distinct;
• sample assets from the inventory and confirm classification is assigned;
• confirm handling requirements exist for each classification;
• interview users to test understanding;
• check whether asset owners participate in classification;
• verify review, upgrade, downgrade, or expiry process;
• test interaction with external classification schemes.

The auditor should reject vague schemes that sound good but do not drive handling behavior.

Evidence examples

Strong evidence

• Scheme has clear levels and definitions.
• Handling requirements are defined for each level.
• Asset owners assign or approve classification.
• Asset inventory records classification.
• Staff understand the labels.
• Classification is reviewed and updated when sensitivity changes.
• External classification schemes are mapped or interpreted.

Weak evidence

• Labels exist but no one knows what they mean.
• Too many levels with unclear differences.
• Classification not recorded in the asset inventory.
• All information marked confidential by default with no justification.
• No process to downgrade stale information.
• Client classification labels are accepted without interpretation.
• Handling rules do not change across classifications.

Common failures

Exam traps

• There is no universal ISO classification label set.
• Classification is normally about information, not every asset type, although systems may be approved for certain classifications.
• Classification must consider confidentiality, integrity, availability, and interested-party requirements.
• Classification labels alone are not enough; handling rules are required.
• Too many classification levels can weaken consistency.
• The asset owner is responsible for classification decisions.

Related controls and concepts

• A.5.9 Inventory of Information and Other Associated Assets
• A.5.10 Acceptable Use of Information and Other Associated Assets
• A.5.13 Labelling of Information
• Information and Associated Asset Inventory
• Risk Assessment
• Statement of Applicability
• Internal Audit

KB-ready summary

A.5.12 requires information to be classified based on protection needs. A usable classification scheme has clear levels, clear definitions, owner accountability, handling requirements, review rules, and support for external classification schemes where relevant.

Templates and checklists

• Information Classification and Handling Matrix
• A.5.12 Audit Checklist
• Information and Associated Asset Inventory