A.5.12 Audit Checklist

When to use this

Use this during internal audits to verify that information classification is defined, implemented, understood, and maintained.

Checklist

• Classification scheme is documented.
• Classification levels are clear and distinct.
• Scheme considers confidentiality, integrity, availability, and interested-party requirements.
• Default classification rules are defined.
• Asset owner responsibility for classification is defined.
• Information assets in scope have classification assigned.
• Handling requirements are defined for each classification.
• Staff are trained on classification meanings.
• Classifications are reviewed, upgraded, downgraded, or expired when needed.
• External or client classification labels are mapped or interpreted.
• Sampled information is classified consistently.

Related notes

• A.5.12 Classification of Information
• A.5.12 Audit Evidence Pack
• Information Classification and Handling Matrix