Labelling of information

What the requirement asks

Procedures for labelling information are to be developed and put into effect in line with the classification scheme the organization has adopted. Purpose: make classifications visible to people and systems and support automated processing and management of information. Guidance: labelling procedures cover information and associated assets in every format, reflect the scheme from 5.12 and use labels that are easy to recognize. They explain where and how labels go, depending on the way people reach the information or handle the media, and can set when labelling is skipped (for example non-confidential material, to save effort), how to label information held or sent electronically, physically or otherwise, and what to do where labelling is technically impossible. Techniques include physical labels, headers and footers, metadata, watermarks and stamps. Digital information should carry metadata that supports identification, management and control, particularly for confidentiality, enables accurate searching, and lets systems act on the labels; procedures describe how metadata is attached, which labels apply and how data is handled, consistent with the information model and ICT architecture, and systems add further metadata as they process information. Staff and other interested parties are made aware of the procedures and trained to label and handle correctly. System output containing sensitive or critical information carries the right label. Other information: labels are central to information sharing; recording the creating process and time is useful; labels can also help attackers spot valuable assets; some systems protect everything at the highest level they may contain and label only on export. In the ISMS the control is compared with the controls determined in risk treatment and recorded in the Statement of Applicability as included or excluded, with the reason and the implementation status.

What the guidance adds

Labelling makes classification visible. The guidance asks for the label set, where it is applied, how it survives transfer and how a recipient knows what to do.

What good looks like

Put the control in the Statement of Applicability with an owner, a status and the risk it treats. Then keep labelling procedures covering all formats, with rules on placement, exemptions and cases where labelling is not possible and one live sample together.

Evidence an assessor asks for

• Labelling proceduresLabelling procedures covering all formats, with rules on placement, exemptions and cases where labelling is not possible
• Labelling proceduresExamples of labelled documents, emails, reports and media showing the chosen techniques such as headers, watermarks or metadata
• Labelling proceduresConfiguration of labelling or data classification tooling that applies metadata and enforces handling decisions
• Labelling proceduresEvidence that sensitive system outputs such as reports and exports carry classification labels
• Labelling proceduresTraining records for personnel on labelling and handling
• Labelling proceduresDocumented handling for systems that protect at the highest level and label on export

The question an assessor will ask

An assessor will ask for labelling procedures covering all formats, with rules on placement, exemptions and cases where labelling is not possible, then trace it to the system it protects. For A.5.13 the test is whether that record ties to a live sample, not whether the control is named in a policy.

Common gaps

• Labels exist on documents but not in metadata, so DLP and other systems cannot act on them
• Reports and data exports from business systems carry no label
• Labelling rules for physical media and paper are missing
• Users are never trained, so labels are applied inconsistently or not at all

Before the next audit

Before the next audit, check one live sample for this gap: labels exist on documents but not in metadata, so dlp and other systems cannot act on them.