Classification of information

What the requirement asks

Information is to be classified according to the organization's security needs, judged on confidentiality, integrity, availability and the requirements of relevant interested parties. Purpose: make the protection needs of information known and understood in proportion to its importance. Guidance: set a topic-specific classification policy and share it with all relevant interested parties. The scheme accounts for confidentiality, integrity and availability, business needs to share or restrict, legal requirements, and may extend to other assets according to the information they hold or process. Information owners are accountable for classifying their information. The scheme sets classification conventions and criteria for reviewing classifications over time, and classifications are updated as value, sensitivity and criticality change across the life cycle. It should align with the access control policy, meet specific business needs, may base levels on the impact of compromise, and should give each level a meaningful name. It must be applied consistently across the organization and built into procedures so everyone classifies the same way. Because other organizations' schemes differ even with similar level names, and information may be treated differently in each context, information-sharing agreements should include how to identify and interpret the other party's classifications, matching levels by equivalent handling and protection. Other information: classification gives handlers a quick signal of how to protect information and avoids assessing risk and designing controls item by item; sensitivity can lapse (published information still needs integrity and availability protection); over-classifying adds cost and under-classifying leaves information exposed; a four-level confidentiality example runs from no harm, through minor reputational or operational impact and significant short-term impact, to serious long-term impact or a threat to survival. In the ISMS the control is compared with the controls determined in risk treatment and recorded in the Statement of Applicability as included or excluded, with the reason and the implementation status.

What the guidance adds

Classification is expected to drive handling. The guidance asks for the scheme, the criteria, the owner who assigns it and the handling rules that follow from each level.

What good looks like

Put the control in the Statement of Applicability with an owner, a status and the risk it treats. Then keep the topic-specific classification policy with named levels, criteria based on impact, and conventions covering confidentiality, integrity and availability and one live sample together.

Evidence an assessor asks for

• Classification schemeThe topic-specific classification policy with named levels, criteria based on impact, and conventions covering confidentiality, integrity and availability
• Classification schemeEvidence the scheme was communicated to relevant interested parties and built into procedures
• Classification schemeClassification records in the asset inventory or labels showing owner-assigned classifications
• Classification schemeRecords of classification reviews and reclassification when sensitivity or criticality changed
• Classification schemeInformation-sharing agreements that map the other party's classification levels to the organization's own
• Classification schemeAlignment between the classification scheme and the access control policy

The question an assessor will ask

An assessor will ask for the topic-specific classification policy with named levels, criteria based on impact, and conventions covering confidentiality, integrity and availability, then trace it to the system it protects. For A.5.12 the test is whether that record ties to a live sample, not whether the control is named in a policy.

Common gaps

• Everything is classified as confidential, so the scheme gives no useful handling signal
• Classifications are never revisited once information is published or ages
• Integrity and availability are ignored and only confidentiality is classified
• Information received from partners is handled under their labels with no agreed map

Before the next audit

Before the next audit, check one live sample for this gap: everything is classified as confidential, so the scheme gives no useful handling signal.