ISO 27001 A.5.13 - Labelling of Information

Requirement

“An appropriate set of procedures for information labelling shall be developed and implemented in accordance with the information classification scheme adopted by the organization.”

Plain-language meaning

If information is classified, people need a practical way to see or infer the classification so they can handle it correctly.

Labelling makes classification visible enough to drive behavior. It can be explicit, such as a document footer, or contextual, such as a rule that everything in a restricted environment is treated as a specific classification.

Why this matters

Classification without labelling is easy to mishandle. Users may forward, print, store, or dispose of information incorrectly because the classification is not visible at the point of use.

Labelling helps with:

• access decisions;
• handling decisions;
• secure transmission;
• secure storage;
• secure printing;
• disposal;
• recipient awareness;
• external sharing.

Implementation guidance

1. Align labels to the classification scheme

Labelling procedures should match A.5.12 Classification of Information.

For each classification, define:

• whether labelling is required;
• where the label appears;
• who applies it;
• whether expiry or review dates are used;
• what happens when information changes format;
• how external labels are interpreted.

2. Label information in forms that users actually handle

Examples:

The label should represent the most sensitive information in the container where practical.

3. Preserve labels when information changes form

Labelling procedures should address:

• printing digital documents;
• converting files to PDF;
• forwarding emails;
• exporting reports;
• copying data to removable media;
• moving data between systems;
• sharing externally.

If labels disappear during format changes, the control fails at exactly the point mishandling becomes likely.

4. Handle cases where visible labels create risk

Sometimes obvious labels can help attackers identify the most valuable information.

In those cases, the organization may use disguised, restricted, or role-specific labelling. That only works if distribution is tightly controlled and the people handling the information are trained.

Do not use “labels might attract attackers” as an excuse for no labelling process. That is weak unless there is a controlled alternative.

5. Interpret external labels carefully

Different organizations may use similar labels with different meanings.

Before relying on external labels:

• confirm what the label means;
• map it to internal handling rules;
• ensure recipients understand your labels;
• document agreed handling in contracts or exchange procedures.

6. Use expiry or review dates where useful

Some information stops being sensitive after a date or event.

Examples:

• financial results after public release;
• project details after launch;
• tender information after award;
• incident details after public disclosure.

Expiry dates can avoid unnecessary protection cost and reduce over-classification.

Audit guidance

Auditors should confirm that labelling procedures exist, match the classification scheme, and work in practice across physical and digital formats.

Audit tests:

• sample classified documents and check labels;
• sample loose pages, printouts, emails, folders, repositories, and removable media;
• check whether labels survive printing or export;
• check whether system/database labels represent the most sensitive contained information;
• check whether external labels are understood;
• inspect whether labels are prominent and durable enough;
• interview users to confirm they understand what labels mean.

Evidence examples

Strong evidence

• Labelling procedure maps clearly to classification levels.
• Labels are visible at the point of use.
• Digital and physical formats are covered.
• Labels persist across printing, export, email, and transfer where practical.
• External labels are mapped to internal handling requirements.
• Highly sensitive information has controlled labelling and distribution.
• Users understand how to apply and interpret labels.

Weak evidence

• Classification exists but no labelling procedure.
• Labels appear only on cover pages while loose pages are unmarked.
• Digital labels disappear when printed or exported.
• Folder labels conflict with document content.
• External labels are accepted without interpretation.
• Adhesive labels fall off physical media.
• Users do not know what labels require them to do.

Common failures

Exam traps

• Labelling supports classification; it is not the same as classification.
• Labelling must suit the form of information.
• Digital information can be labelled through metadata, sensitivity labels, folders, repositories, or system-level rules.
• Labels should remain with information when it changes form where practical.
• The label should represent the most sensitive information in the container.
• Sometimes visible labelling can create risk; alternative controlled approaches may be justified.

Related controls and concepts

• A.5.12 Classification of Information
• A.5.10 Acceptable Use of Information and Other Associated Assets
• Information Classification and Handling Matrix
• Information and Associated Asset Inventory
• Risk Assessment
• Internal Audit

KB-ready summary

A.5.13 requires procedures for labelling information in line with the classification scheme. Labelling should make classification visible or otherwise actionable across physical, digital, transmitted, stored, printed, and transformed information so users apply the right handling controls.

Templates and checklists

• Information Classification and Handling Matrix
• A.5.13 Audit Checklist
• Acceptable Use and Information Handling Rules