Information Classification & Handling Pack — Guide
- Version 2.0
- Updated
- 8 documents
- Word, Excel
Information Classification & Handling
Most organisations that try classification end up in one of two places. Either nothing is labelled and everyone decides for themselves what may be emailed, or everything is labelled Confidential and the label stops meaning anything. This pack avoids both. It gives you three levels, a default that most information never leaves, and a decision based on the harm that could follow, read from the same impact scale your risk register uses. Each level then tells people exactly what to do when they store, share, print, take home, put into an AI tool, keep or throw away the information.
Is this for you?
This pack is for you if:
- staff ask “may I send this?” and get a different answer from each manager;
- your labels say Confidential on almost everything, or on nothing;
- exports of customer or payroll data sit in team folders nobody owns;
- you could not say which suppliers hold which of your information;
- old laptops leave the building and nobody checks the certificate that comes back.
Three levels
Every information asset has an owner, and the owner decides its level. Rate the harm if the wrong person saw it, if it were changed without authority, and if it could not be used when needed. Each rating is Low, Medium or High, read from your risk scale: Low is Minor, Medium is Moderate, and High is Major or Severe. The highest rating sets the level.
| Level | What it means | When it applies | Label |
|---|---|---|---|
| Public | Approved for public release. No confidentiality restriction remains. | Every impact is Low, and the owner has approved release to anyone | None needed |
| Internal | For the organisation and approved suppliers. Unauthorised disclosure could cause limited harm. | The highest impact is Medium, or nothing is High but release has not been approved. All new business information starts here | Where the medium supports it |
| Confidential | Restricted to named roles or recipients. Unauthorised disclosure, change or loss could cause material harm. | Any impact is High | Always, on every copy |
Three things sit on top of the level. Personal data is protected under data protection law whatever its label, so it carries a Personal data marker at every level. Health and other special category data, and personal or customer data at scale, are always Confidential. A legal hold stops deletion and disposal until Legal releases it. And a file that combines information takes the level of the whole: one customer’s price list goes to that customer, but every customer’s prices in one file is Confidential.
The companion question, How do we classify information without everything ending up “Confidential”?, walks through the same decision as a flow.
How it runs in practice
Take a wholesale distributor with 900 staff, three warehouses and an online ordering service. It approved its classification policy on 14 July and built its information asset register in August. At 30 September the register holds 17 assets. The owners have classified 16 of them: 2 Public, 7 Internal and 7 Confidential. The 17th is a freight rate comparison site found in September, still handled as Internal while its owner decides.
In September a handling check looked at where Confidential information actually lived. The monthly export of every customer’s prices and discounts sat on a sales team site that all 900 staff could open, labelled Internal. In August the owner had rated it on the basis that each customer receives its own price list. Combined, the prices would let a competitor undercut every bid, so the owner re-rated the export Confidential the same day and moved it to a location only the 40 sales account managers can reach. The access log showed three people outside sales had opened it, all in finance, and none of it had left the company.
The quarter also had one handling incident. A customer service agent emailed a spreadsheet of 212 customers’ names, delivery addresses and order histories to the wrong business customer, picking the address from autocomplete. It went through the incident process as a personal data breach and was notified to the supervisory authority in time. Under this pack, the same export should have carried a Confidential label and gone by an expiring encrypted link to an address checked first. Exports of the order history now go only to a labelled Confidential folder.
Finally, 24 retired laptops went to the disposal provider on 8 September. The certificate came back on 21 September with 23 serial numbers on it. The missing laptop was chased the next day. If the provider cannot account for it by 6 October, it is reported as a suspected loss of an encrypted device.
Start with these three
- Information Classification & Handling Policy: the three levels, the twenty rules and how the decision is made.
- Classification Level Handling Rules Matrix: what each level means for storing, sharing, printing, remote working, AI tools, keeping and disposing.
- Information Asset Register: every information asset with its owner, level, markers, who may access it and when it is next reviewed.
Your first month
| When | What to do | You’re done when |
|---|---|---|
| Week 1 | Agree the three levels, the impact ratings and the owners with your leadership team, and approve the policy. | The policy is approved and every function head knows they own information. |
| Week 2 | List your information assets, starting with customer, payroll, HR, pricing and supplier bank data, and the systems and suppliers that hold them. | Each asset has an owner and a place in the register. |
| Week 3 | Owners rate each asset and decide its level; look for exports and copies of the Confidential ones. | Every listed asset has a level and a reason, and every Confidential export is in a restricted location. |
| Week 4 | Brief staff with the quick-reference card, set the email and document labels, and check your disposal provider’s last certificate against what you sent. | Staff know the default, Confidential email is labelled, and every disposed item is on a certificate. |
What to report
Report these every month to the security and IT leadership team, and take any that is outside tolerance to the executive committee with its plan:
- information assets with an owner and an approved level;
- classification reviews on time, including after a material change;
- incidents caused by mislabelled or mishandled information, each with its cause fixed;
- items that held Confidential information disposed of with a matching certificate.
Everything in the pack
- Word
Information Classification & Handling Policy
The levels, the rules, the decision and who owns what
- Excel
Classification Level Handling Rules Matrix
The handling rule for every action at every level
- Word
Classification & Labelling Procedure
How to classify, label each medium, and reclassify
- Excel
Information Asset Register
Every information asset, its owner, level and review
- Excel
Information Asset Classification Workbook
Rates the three impacts against your risk scale and suggests the level
- Excel
Secure Information Disposal Checklist
The method for each media type, and the certificate reconciled item by item
- Word
Classification Quick-Reference Card & Staff Briefing
The everyday version for staff, with a briefing script
- Excel
Information Ownership Responsibility Matrix
Who decides, who applies, who advises and who is told
No document matches those words.
Adapting it
- Small organisation: keep the three levels and let the managing director own most information. The register can start with ten assets; the customer, payroll and pricing data matter most.
- Suppliers holding your information: a supplier that stores or receives Internal or Confidential information does so under the contract clauses of the third-party security pack, and Confidential information goes to it only after its assessment.
- Access: grant access to Confidential information through the role profiles of the joiner-mover-leaver pack; administrator access to the systems that hold it follows the privileged access pack.
- Personal data: your Data Protection Officer or privacy lead advises on every asset with the Personal data marker, and a suspected breach follows the GDPR route of the incident management pack.
- Financial entity: DORA’s technical standards ask for access restrictions, secure deletion and disposal of storage devices, all set by your data classification. The handling matrix and the disposal checklist are written to that level.
Where it maps
- ISO/IEC 27001:2022: Annex A 5.12.
- NIST CSF 2.0: ID.AM-05.
- NIS2: Article 21(2)(i).
- DORA: Article 8.
- GDPR: Article 5(1)(f) and Article 32.