Control A.5.12Classification of information
Information must be classified according to the information security needs of the organisation, based on confidentiality, integrity, availability and relevant interested party requirements.
The point of a scheme is to let everything else be proportionate: handling rules under A.5.10, access decisions under A.5.15, retention and protection under A.5.33, and the strength of protection under A.8.24.
Classification is the organisation’s own, and the pressure is always towards too many levels. Three or four that people can apply consistently are worth more than six applied by guesswork. The standard also asks for it to be based on more than confidentiality — integrity and availability change the answer for operational and financial data that is not sensitive but must be right and present.
The clause mentions interested party requirements, which is where contractual and regulatory classifications — a customer’s own scheme, a supervisor’s categories — have to be reconciled rather than run alongside.
How to put this in place
Not all information needs the same protection, and treating it all alike either wastes money or leaves the valuable parts exposed. A scheme people can use lets the ISMS match controls to value.
- Decide three or four levels and write a plain example of each.
- Define handling rules for each level, covering storage, sharing and disposal.
- Make information owners responsible for assigning levels.
- Record the level in the inventory.
- Train staff, and review the scheme when your information or tools change; see also A.5.13 and A.5.14.
Evidence an auditor usually looks for: the classification scheme, the inventory showing levels, and staff able to explain the levels.
What is in the packs for this
From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.
Annex A Control Implementation LibraryExcel
Its row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies.
Statement of Applicability TemplateExcel
Has its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented.
Mandatory ISMS Documentation ChecklistExcel
Annex A Documents sheet: lists classification scheme among the documents auditors commonly expect for this control.