Information Classification & Handling Pack — Guide
- Version 2.0
- Updated
- Next review
Information Classification & Handling
Most organisations that try classification end up in one of two places. Either nothing is labelled and everyone decides for themselves what may be emailed, or everything is labelled Confidential and the label stops meaning anything. This pack avoids both. It gives you three levels, a default that most information never leaves, and a decision based on the harm that could follow, read from the same impact scale your risk register uses. Each level then tells people exactly what to do when they store, share, print, take home, put into an AI tool, keep or throw away the information.
Is this for you?
This pack is for you if:
- staff ask “may I send this?” and get a different answer from each manager;
- your labels say Confidential on almost everything, or on nothing;
- exports of customer or payroll data sit in team folders nobody owns;
- you could not say which suppliers hold which of your information;
- old laptops leave the building and nobody checks the certificate that comes back.
Three levels
Every information asset has an owner, and the owner decides its level. Rate the harm if the wrong person saw it, if it were changed without authority, and if it could not be used when needed. Each rating is Low, Medium or High, read from your risk scale: Low is Minor, Medium is Moderate, and High is Major or Severe. The highest rating sets the level.
| Level | What it means | When it applies | Label |
|---|---|---|---|
| Public | Approved for public release. No confidentiality restriction remains. | Every impact is Low, and the owner has approved release to anyone | None needed |
| Internal | For the organisation and approved suppliers. Unauthorised disclosure could cause limited harm. | The highest impact is Medium, or nothing is High but release has not been approved. All new business information starts here | Where the medium supports it |
| Confidential | Restricted to named roles or recipients. Unauthorised disclosure, change or loss could cause material harm. | Any impact is High | Always, on every copy |
Three things sit on top of the level. Personal data is protected under data protection law whatever its label, so it carries a Personal data marker at every level. Health and other special category data, and personal or customer data at scale, are always Confidential. A legal hold stops deletion and disposal until Legal releases it. And a file that combines information takes the level of the whole: one customer’s price list goes to that customer, but every customer’s prices in one file is Confidential.
The companion question, How do we classify information without everything ending up “Confidential”?, walks through the same decision as a flow.
How it runs in practice
Take a wholesale distributor with 900 staff, three warehouses and an online ordering service. It approved its classification policy on 14 July and built its information asset register in August. At 30 September the register holds 17 assets. The owners have classified 16 of them: 2 Public, 7 Internal and 7 Confidential. The 17th is a freight rate comparison site found in September, still handled as Internal while its owner decides.
In September a handling check looked at where Confidential information actually lived. The monthly export of every customer’s prices and discounts sat on a sales team site that all 900 staff could open, labelled Internal. In August the owner had rated it on the basis that each customer receives its own price list. Combined, the prices would let a competitor undercut every bid, so the owner re-rated the export Confidential the same day and moved it to a location only the 40 sales account managers can reach. The access log showed three people outside sales had opened it, all in finance, and none of it had left the company.
The quarter also had one handling incident. A customer service agent emailed a spreadsheet of 212 customers’ names, delivery addresses and order histories to the wrong business customer, picking the address from autocomplete. It went through the incident process as a personal data breach and was notified to the supervisory authority in time. Under this pack, the same export should have carried a Confidential label and gone by an expiring encrypted link to an address checked first. Exports of the order history now go only to a labelled Confidential folder.
Finally, 24 retired laptops went to the disposal provider on 8 September. The certificate came back on 21 September with 23 serial numbers on it. The missing laptop was chased the next day. If the provider cannot account for it by 6 October, it is reported as a suspected loss of an encrypted device.
Start with these three
- Information Classification & Handling Policy: the three levels, the twenty rules and how the decision is made.
- Classification Level Handling Rules Matrix: what each level means for storing, sharing, printing, remote working, AI tools, keeping and disposing.
- Information Asset Register: every information asset with its owner, level, markers, who may access it and when it is next reviewed.
Your first month
| When | What to do | You’re done when |
|---|---|---|
| Week 1 | Agree the three levels, the impact ratings and the owners with your leadership team, and approve the policy. | The policy is approved and every function head knows they own information. |
| Week 2 | List your information assets, starting with customer, payroll, HR, pricing and supplier bank data, and the systems and suppliers that hold them. | Each asset has an owner and a place in the register. |
| Week 3 | Owners rate each asset and decide its level; look for exports and copies of the Confidential ones. | Every listed asset has a level and a reason, and every Confidential export is in a restricted location. |
| Week 4 | Brief staff with the quick-reference card, set the email and document labels, and check your disposal provider’s last certificate against what you sent. | Staff know the default, Confidential email is labelled, and every disposed item is on a certificate. |
What to report
Report these every month to the security and IT leadership team, and take any that is outside tolerance to the executive committee with its plan:
- information assets with an owner and an approved level;
- classification reviews on time, including after a material change;
- incidents caused by mislabelled or mishandled information, each with its cause fixed;
- items that held Confidential information disposed of with a matching certificate.
Everything in the pack
| Document | What it does | Format |
|---|---|---|
| Information Classification & Handling Policy | The levels, the rules, the decision and who owns what | Word |
| Classification Level Handling Rules Matrix | The handling rule for every action at every level | Excel |
| Classification & Labelling Procedure | How to classify, label each medium, and reclassify | Word |
| Information Asset Register | Every information asset, its owner, level and review | Excel |
| Information Asset Classification Workbook | Rates the three impacts against your risk scale and suggests the level | Excel |
| Secure Information Disposal Checklist | The method for each media type, and the certificate reconciled item by item | Excel |
| Classification Quick-Reference Card & Staff Briefing | The everyday version for staff, with a briefing script | Word |
| Information Ownership Responsibility Matrix | Who decides, who applies, who advises and who is told | Excel |
Adapting it
- Small organisation: keep the three levels and let the managing director own most information. The register can start with ten assets; the customer, payroll and pricing data matter most.
- Suppliers holding your information: a supplier that stores or receives Internal or Confidential information does so under the contract clauses of the third-party security pack, and Confidential information goes to it only after its assessment.
- Access: grant access to Confidential information through the role profiles of the joiner-mover-leaver pack; administrator access to the systems that hold it follows the privileged access pack.
- Personal data: your Data Protection Officer or privacy lead advises on every asset with the Personal data marker, and a suspected breach follows the GDPR route of the incident management pack.
- Financial entity: DORA’s technical standards ask for access restrictions, secure deletion and disposal of storage devices, all set by your data classification. The handling matrix and the disposal checklist are written to that level.
Where it maps
- ISO/IEC 27001:2022: Annex A 5.12.
- NIST CSF 2.0: ID.AM-05.
- NIS2: Article 21(2)(i).
- DORA: Article 8.
- GDPR: Article 5(1)(f) and Article 32.
What changed
Each change to this pack's documents since it was published, newest first.Changes across all packs
Rewritten with the rest of the pack to the depth of the other CISO Times packs: who the pack is for; the three levels with the impact ratings read from the risk scale and the markers that sit on top; a worked quarter at the distributor; the three documents to start with; a first-month plan; the four measures to report; adapting it for a small organisation, suppliers and access; and where it maps.
- Guide 1.0 → 2.0
Rewritten to the depth of the other CISO Times packs: the levels now come with their meaning, labels and examples; impact is read from the risk scale; the decision has its special cases and worked decisions; rules CL-13 to CL-20 are added; every statement names its evidence; roles, measures, exceptions and a worked example of the first quarter are added.
Rewritten to the depth of the other CISO Times packs: the 10 actions at each of the 3 levels, with the rules each applies and the other packs it relies on; the levels, the three markers and the rules on one sheet; labelling for 8 media; and a lookup that gives the rule, the label and the marker rules for any piece of information, checked for special category data and legal holds, with the distributor's worked example.
Rewritten to the depth of the other CISO Times packs: the decision in eight steps with owners, times and outputs; labels for every medium; the setup for a Confidential asset; reclassification triggers; the quarterly handling check; legal holds, disposal and the certificate check; reporting mishandling; and three worked examples from the distributor's quarter.
- Classification & Labelling Procedure 1.0 → 2.0
Rewritten to the depth of the other CISO Times packs: the 16 register fields in full, the three impacts on the risk scale with the level they give beside the owner's level, markers, access, retention and a calculated review date; a change log and legal holds; a Summary with the measures ICM-01 and ICM-02; a Field guide; and the distributor's 17 assets as the worked example.
- Information Asset Register 1.0 → 2.0
Rewritten to the depth of the other CISO Times packs: impact criteria for 5 areas on the risk scale's four impact levels, the three questions with examples, and the decision steps and special cases; an impact-by-area worksheet that rates an asset on its own and combined (CL-13); the assessment of every asset with ratings, markers, the level they give and the owner's decision; the reclassification record and its triggers; a summary; and the distributor's 17 assets and re-rated price export as the worked example.
Rewritten to the depth of the other CISO Times packs: a checklist of 21 items in 5 areas for each disposal batch, with critical items and a closed status; a disposal log that checks the method, the certificate window and the chase for each batch; a tag-by-tag reconciliation of manifest and certificate; the three methods for 10 media types at each level, the certificate's fields and the providers' tiers; a Summary with ICM-04 and a signature block; and the distributor's quarter of disposals, with a laptop missing from a certificate, as the worked example.
- Secure Information Disposal Checklist 1.0 → 2.0
Rewritten to the depth of the other CISO Times packs: a one-page card in staff words, everyday examples drawn from the register, a twenty-minute briefing script with what to say, show and ask, short and team versions, the questions staff ask, scenarios, a follow-up message and a briefing record.
Rewritten to the depth of the other CISO Times packs: the 14 activities RS-01 to RS-14, each with the rule it serves, against 6 roles including the privacy and records roles, checked for one accountable role; role holders and deputies with their counts; the owner and custodian of every asset in the register; an ownership check; and the distributor's owners as the worked example.
Published. The guide and eight documents, at 1.0.