Control A.5.12Classification of information
What it means in practice
Information must be classified according to the information security needs of the organisation, based on confidentiality, integrity, availability and relevant interested party requirements.
The point of a scheme is to let everything else be proportionate: handling rules under A.5.10, access decisions under A.5.15, retention and protection under A.5.33, and the strength of protection under A.8.24.
Classification is the organisation’s own, and the pressure is always towards too many levels. Three or four that people can apply consistently are worth more than six applied by guesswork. The standard also asks for it to be based on more than confidentiality — integrity and availability change the answer for operational and financial data that is not sensitive but must be right and present.
The clause mentions interested party requirements, which is where contractual and regulatory classifications — a customer’s own scheme, a supervisor’s categories — have to be reconciled rather than run alongside.
How to put this in place
Not all information needs the same protection, and treating it all alike either wastes money or leaves the valuable parts exposed. A scheme people can use lets the ISMS match controls to value.
- Decide three or four levels and write a plain example of each.
- Define handling rules for each level, covering storage, sharing and disposal.
- Make information owners responsible for assigning levels.
- Record the level in the inventory.
- Train staff, and review the scheme when your information or tools change; see also A.5.13 and A.5.14.
Evidence an auditor usually looks for: the classification scheme, the inventory showing levels, and staff able to explain the levels.
What is in the packs for this
Each one helps with this requirement.
- Excel
Annex A Control Implementation Library
in ISO 27001 Implementation & Certification ReadinessIts row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies. - Excel
Statement of Applicability Template
in ISO 27001 Implementation & Certification ReadinessHas its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented. - Excel
Mandatory ISMS Documentation Checklist
in ISO 27001 Implementation & Certification ReadinessAnnex A Documents sheet: lists classification scheme among the documents auditors commonly expect for this control. - Word
Information Classification & Handling Policy
in Information Classification & HandlingIts Framework References list this control. Supported by: Classification levels; Decision method; CL-01 to CL-05, CL-13, CL-14. - Excel
Classification Level Handling Rules Matrix
in Information Classification & HandlingIts Framework References list this control. Supported by: Levels and markers: the levels the handling rules are set for. - Word
Classification & Labelling Procedure
in Information Classification & HandlingIts Framework References list this control. Supported by: Classifying an information asset; reclassification. - Excel
Information Asset Register
in Information Classification & HandlingIts Framework References list this control. Supported by: Information assets: the three impacts, the level they give and the owner's level. - Excel
Information Asset Classification Workbook
in Information Classification & HandlingIts Framework References list this control. Supported by: Classification assessment: each asset's level from its confidentiality, integrity and availability impacts. - Excel
AI Tool Approval & Data Permission Matrix
in AI Security Governance & Acceptable UseIts Framework References list this control. Supported by: Data class and highest level columns: information classified by P15's levels decides what each tool may take.