A.5.13 Audit Checklist

When to use this

Use this during internal audits to verify that information labelling procedures are defined and implemented in line with the classification scheme.

Checklist

• Labelling procedure is documented.
• Labelling procedure aligns with the classification scheme.
• Labelling rules cover physical documents.
• Labelling rules cover digital documents, repositories, systems, or metadata where relevant.
• Labels are prominent or otherwise actionable.
• Labels represent the most sensitive information in the container where practical.
• Labels persist when information is printed, exported, emailed, or transferred where practical.
• Exceptions for disguised or restricted labelling are justified and controlled.
• External labels are interpreted or mapped.
• Users understand how to apply and interpret labels.
• Expiry or review dates are used where useful.

Related notes

• A.5.13 Labelling of Information
• A.5.13 Audit Evidence Pack
• Information Classification and Handling Matrix