Control A.5.13Labelling of information
An appropriate set of procedures for information labelling must be developed and implemented in accordance with the classification scheme adopted by the organisation.
Labelling is what makes classification visible at the moment of use. A document classified in a register and unmarked in the hands of the person about to email it is classified in theory only.
The procedures must cover physical and electronic forms, and the practical difficulty is that labels have to survive the ways information actually moves — copied into a message, exported to a spreadsheet, pasted into a chat. Metadata-based labelling addresses part of that and does not address all of it.
The judgement worth making deliberately is how much to label. Labelling everything trains people to ignore labels; labelling the top one or two levels keeps the signal meaningful. What matters for the control is that the procedures exist, follow the scheme in A.5.12, and are applied consistently enough that an unlabelled item can be assumed to be routine.
How to put this in place
A classification that cannot be seen at the point of use is easy to ignore. Labels tell whoever handles a document which rules apply, without guesswork.
- Decide how each level is marked: document headers, email subject tags, tool labels and physical media labels.
- State what needs no label, such as Internal by default.
- Turn on default or automatic labelling in your tools where they allow it.
- Write the labelling steps into the handling procedure.
- Check a sample of documents and emails for correct labels, and fix the causes.
Evidence an auditor usually looks for: the labelling procedure, a sample of documents and emails showing labels, and tool settings for default labels.
What is in the packs for this
From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.
Annex A Control Implementation LibraryExcel
Its row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies.
Statement of Applicability TemplateExcel
Has its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented.