Classification & Labelling Procedure
Defines how owners classify information, how labels are applied, and how reclassification is handled.
Available soon
- Format
- Word
- Size
- 70 KB
- Length
- 22 pages
- Version
- 2.0
- Updated
What's inside
- Purpose and triggers
- Scope
- Roles
- Inputs
- Classifying an information asset
- Labelling by medium
- Setting up handling for a Confidential asset
- Reclassification and declassification
- Handling checks
- Retention, legal holds and disposal
- Reporting mishandling
- Outputs and records
- Timing targets
- Disagreement and escalation
- Worked example: the price export
- Worked example: the order history sent to the wrong customer
- Worked example: a certificate one laptop short
- Related documents
- Adapting this template
- Framework references
- Definitions
What changed
- 2.0
Rewritten to the depth of the other CISO Times packs: the decision in eight steps with owners, times and outputs; labels for every medium; the setup for a Confidential asset; reclassification triggers; the quarterly handling check; legal holds, disposal and the certificate check; reporting mishandling; and three worked examples from the distributor's quarter.
- 1.0
Published.
Preview
The document from section 1, as you will receive it. Highlighted [[text]] is for you to replace; shaded guidance boxes are for you to delete before approval. The cover and document control pages are in the file.
Purpose and triggers
This procedure is how an information owner gives information its level, how the level is carried on every copy, and how it is changed when something changes. It is the working routine behind the Information Classification & Handling Policy: the policy sets the levels and the rules (CL-01 to CL-20); this procedure says who does what, in which order and by when.
It answers four questions in writing for every information asset: what level is it and why, how is the level shown, what handling has been set up, and when is it looked at again.
Use this procedure whenever one of these happens:
Trigger | What to do | Where |
|---|---|---|
New information asset, system, location or regular export | Classify it before it is first used, shared or retained (CL-01). | Classifying an information asset |
An owner takes on an existing asset, or the register shows one awaiting a decision | Confirm or make the decision; it is handled as Internal meanwhile (CL-04). | Classifying an information asset |
A material change: a new system, location or regular export; a new supplier, or a change in what a supplier does with it; a new purpose or audience; personal or special category data added; an incident involving it; a change in law or contract | Review the level within [[15]] working days of the change (CL-03). | Reclassification and declassification |
One of the reclassification triggers RT-01 to RT-10 | Rate the impacts again and record the outcome (CL-10). | Reclassification and declassification |
The annual review falls due | Confirm the level, owner, location, markers and retention (CL-12), at least every [[12]] months. | Reclassification and declassification |
Information found unlabelled, labelled lower than its level, or in the wrong place | Apply the unlabelled rule, and report it if it was exposed (CL-18). | Labelling by medium; Reporting mishandling |
Information or a medium reaches the end of its retention, or a device is retired | Check for a legal hold, then dispose by the media method with a certificate (CL-11, CL-15). | Retention, legal holds and disposal |
Guidance — delete before approval
The procedure must not change a level, a rule, a label or a time set in the Information Classification & Handling Policy or the Classification Level Handling Rules Matrix. If you need a different value, change it there first, then here.
Most of the work is in the first month: building the register and classifying the assets that matter. After that the procedure runs on triggers, and most triggers take an owner ten minutes.
Scope
This procedure applies to:
- every information asset in the register, and every new one, in any form and wherever it is held, including at suppliers;
- the systems, devices and media that hold them, which take the level of the most sensitive information they hold (CL-01);
- everyone in the roles below, including supplier staff who act as custodians.
It does not cover what each level requires for every action (the Classification Level Handling Rules Matrix), how the impact criteria are scored (the Information Asset Classification Workbook), the disposal method for each media type in detail (the Secure Information Disposal Checklist), or how an incident is handled once reported (the incident management pack). It hands over to each at the step named.
Roles
Role | What they do in this procedure |
|---|---|
Information owner [[e.g. system owner or the head of the function the information serves]] | Classifies each asset they own: rates the impacts, takes the level, adds the markers, approves and records the decision, reviews it on time, approves any release or lowering, and agrees the actions from a handling check. |
Custodian [[e.g. Head of IT, system administrator or the supplier that hosts it]] | Records where the asset is held and every regular export; sets up the labels, location, access, encryption and retention the level requires; carries out disposal and keeps the manifest. |
User [[everyone: staff, contractors and supplier staff]] | Applies the label when creating or copying information; follows the handling rule; treats unlabelled information by the unlabelled rule; reports mishandling at once. |
Head of Information Security [[e.g. Head of Information Security]] | Advises owners on impact; checks each new Confidential decision; runs the quarterly handling check and the certificate reconciliation; reports the measures. |
Data Protection Officer [[or the privacy lead where no DPO is appointed]] | Is consulted on every asset with the Personal data marker that is new or changed, and on every Special category asset; advises on retention of personal data and on any suspected personal data breach. |
Records manager [[e.g. Company Secretary or Head of Legal]] | Keeps the retention schedule and the legal hold list; applies and releases holds; keeps disposal certificates and records. |
Guidance — delete before approval
In a small organisation the custodian may be the IT provider and the Head of Information Security the IT manager. The information owner must still be a manager in the business who answers for the information: IT can advise on a level, but it does not decide it.
Inputs
Input | Where it comes from | Used at |
|---|---|---|
The levels, markers and rules | Information Classification & Handling Policy | Every step |
The impact criteria and the rating worksheet | Information Asset Classification Workbook | Steps 2 to 4 |
The risk scale's impact levels | Risk Assessment Methodology & Scoring Model | Step 2 |
The register: assets, owners, locations, exports, review dates | Information Asset Register | Steps 1, 6 and 8; reviews; handling checks |
The handling rule for every action at every level | Classification Level Handling Rules Matrix | Step 7; the Confidential setup |
Role profiles and non-standard access | Role-Based Access Profile Matrix | Step 7; the Confidential setup |
The supplier register, tiers and clauses | Supplier Security Risk Register; Supplier Contract Security Clause Library | Step 1; the Confidential setup |
The retention schedule and the legal hold list | [[the organisation's retention schedule, kept by the records manager]] | Retention, legal holds and disposal |
The disposal method by media type and the certificate | Secure Information Disposal Checklist | Retention, legal holds and disposal |
Classifying an information asset
Take the steps in order. Steps 2 to 5 are usually one sitting of the information owner with the custodian, using the Information Asset Classification Workbook.
Step | What to do | Who | When | Output |
|---|---|---|---|---|
1 | Name the information asset, its purpose, its owner, where it is held and every regular copy or export (CL-01). | Information owner; Custodian | Before the information is first used, shared or retained | Register entry opened: asset, purpose, owner, custodian, where held, regular copies and exports |
2 | Rate confidentiality, integrity and availability on the impact criteria, each against every area, taking the worst. Rate the information as it is, before the controls that protect it (CL-02). | Information owner | With step 1; the security role advises | Three ratings, each with its risk scale impact level and the reason |
3 | Check aggregation: does the asset, or an export of it, combine information so that the whole could do more harm than any part? If so, rate the whole (CL-13). | Information owner | With step 2 | Each regular export or collection rated on its own, or recorded as part of the asset |
4 | Take the level the ratings give: any High is Confidential; a highest of Medium is Internal; all Low is Public only once the owner approves release, otherwise Internal (CL-02). | Information owner | With step 2 | The level |
5 | Add the markers that apply: Personal data, Special category (which needs Confidential) and Legal hold (CL-07). | Information owner; Data Protection Officer | With step 4 | Markers recorded; the privacy adviser consulted for Special category |
6 | The owner approves the level and records the reason in the register. While the decision is incomplete, the asset is Internal (CL-03). | Information owner | Within the working days CL-03 allows after a change; at once for a new asset | Approved level and reason in the register; status Classified |
7 | Apply the label for each medium and the handling rule for each action, to the source and to every copy (CL-06). | Custodian; User | Before the information is shared | Labels set in each system; handling set up as the matrix requires |
8 | Set the review date: 12 months, or sooner on a trigger (CL-12). | Information owner | With step 6 | Next review date in the register |
Decision point: which level
Answer in order; stop at the first that settles it. This is the decision of the policy, and the workbook computes it the same way.
Question | Yes | No |
|---|---|---|
Have all three impacts been rated? | Next question. | Internal until the owner decides (CL-04). Record the status as awaiting the owner's decision. |
Is any impact High? | Confidential. | Next question. |
Is the highest impact Medium? | Internal. | Next question. |
Has the owner approved release to anyone, and recorded it? | Public (CL-05). | Internal. |
Guidance — delete before approval
Rate the information as it is, before the controls that protect it: a payroll file is High for confidentiality even though it sits in an encrypted system. The controls are what the level requires; they do not lower it.
If the owner and the security role disagree, the higher level applies until the owner's line manager decides. Record both views.
Checking aggregation
A collection, export, report or copy takes the highest level of anything in it, and a higher level where combining the items raises the impact (CL-13). Ask these questions of the asset and of every regular export or report of it:
- Does the asset, or a regular export of it, put many customers', staff members' or suppliers' records in one place?
- Does it join two kinds of information that are each harmless, such as names with absence reasons, or prices with customer names?
- Would a competitor, a fraudster or a journalist pay more for the whole than for any one part?
- Is there a report, dashboard or spreadsheet that copies the asset out of the system it lives in?
A yes to any of them means the combination is rated on its own. The combination is usually what leaks: a single record is rarely emailed by mistake, a spreadsheet of all of them often is.
Adding markers
Marker | Add it when | What it adds | Who advises |
|---|---|---|---|
Personal data | Any personal data, at any level. | Data protection law applies whatever the level (CL-07): a lawful basis, purpose limits, retention no longer than necessary, the GDPR breach route through the incident pack (CL-18), and processor terms for any supplier that processes it (P06 clause CL-06). | Data Protection Officer |
Special category | Special category personal data (GDPR Article 9), always with the Confidential level. | Access by named people only; never printed outside the office, taken on removable media or put into an AI tool; the Data Protection Officer consulted before any new use or sharing. | Data Protection Officer |
Legal hold | Information Legal has placed under a hold, at any level. | Not changed, deleted or disposed of until Legal releases the hold in writing, whatever the retention schedule says (CL-15). | Records manager |
Recording the decision
The decision is recorded in the Information Asset Register. These fields come from this procedure; the rest are kept by the custodian and the security role.
Field | What to record | Rule |
|---|---|---|
Asset ID | IA-nn | CL-12 |
Information asset and purpose | What it is and what it is for, in the owner's words | CL-01 |
Owner | A named role, never a team | CL-03 |
Custodian | Who runs it: IT, an administrator or a supplier | CL-06 |
Where it is held | Systems, sites and regular copies or exports | CL-01 |
Suppliers that hold it | P06 reference and tier | CL-16 |
Confidentiality, integrity, availability | Each rated Low, Medium or High, with the P05 impact level | CL-02 |
Level | Public, Internal or Confidential | CL-02 |
Markers | Personal data, Special category, Legal hold | CL-07 |
Reason | The harm that sets the level | CL-03 |
Who may access it | P13 role profiles, or non-standard access | CL-17 |
Retention rule | From the retention schedule | CL-11 |
Last material change | Date and what changed | CL-03 |
Last review | Date, and who reviewed | CL-12 |
Next review | Within [[12]] months, or [[15]] working days after a change | CL-12 |
Status | Classified, or awaiting the owner's decision (held Internal) | CL-04 |
Labelling by medium
Use a visible label where the medium supports it, and carry the level into exports, copies, prints and meeting materials. Confidential is always labelled (CL-09). The label is how the next person knows the level. Each medium carries it this way:
Medium | Public | Internal | Confidential |
|---|---|---|---|
No label needed. | The default sensitivity label, where the email system has labels. | "CONFIDENTIAL" at the start of the subject line, and the Confidential sensitivity label where the system has one. | |
Documents and spreadsheets | No label needed. | "Internal" in the footer, or the default sensitivity label. | "Confidential" in the header and footer of every page, and in the document's properties or sensitivity label. |
Files, folders and team sites | The public location only. | The site's or folder's default label. | A location named and restricted as Confidential; every file in it labelled, and exports labelled when they leave it. |
Business systems and databases | Not applicable. | Recorded in the register. | Recorded in the register; a sign-in notice where the system allows; reports and exports carry the label. |
Paper | No label needed. | "Internal" in the footer. | "Confidential" at the top and bottom of every page, and a cover sheet when it leaves the office. |
Meetings and recordings | No label needed. | No label needed. | The invitation and agenda say Confidential; the chair says so at the start; recorded only with the owner's approval, and the recording labelled. |
Conversations and calls | No warning needed. | No warning needed. | Say it is Confidential before sharing it, and check who can hear. |
Devices and removable media | No label needed. | Asset tag only. | Encrypted; labelled with the level and the owner on the device or its case. |
Information without a label
Treat unlabelled business information as Internal (CL-04). Never treat it as Public (CL-05). If it is obviously more sensitive, such as personal data at scale or prices, treat it as Confidential, ask the owner, and report it if it was in the wrong place (CL-18).
Setting labels up in systems
The custodian sets the systems up so that most labels are applied without anyone having to remember:
- Set the default sensitivity label of email, documents and team sites to Internal, where the system supports labels.
- Create a Confidential label that adds the header and footer marking and, where the system supports it, encryption and a block on forwarding outside the organisation.
- Turn on the warning for recipients outside the organisation in email, and stop address autocomplete for teams that send Confidential information out.
- Name and restrict a location for each Confidential asset's working files and exports, open only to the approved role profiles or named people.
- Set each business system's reports and exports of a Confidential asset to carry the label at the source, so every copy is labelled without anyone having to remember.
- Record in the register, for each asset, how its label is carried in each system that holds it.
Copies, exports and prints
A copy, export, print or extract keeps the level of its source and carries its label (CL-09). Whoever makes the copy labels it, unless the system does. A copy that is no longer needed is deleted, and a Confidential copy is recorded in the register if it is kept for more than a working day outside the restricted location. Meeting papers carry the level of the most sensitive item in them.
Guidance — delete before approval
Labels set at the source are worth more than any amount of training. In the EXAMPLE, both of the quarter's problems were exports that left their system without a label.
Setting up handling for a Confidential asset
When an asset is classified Confidential, the custodian sets up the handling the Classification Level Handling Rules Matrix requires and confirms each item to the information owner. The Head of Information Security checks the list for every new Confidential asset.
Check | How | Rule |
|---|---|---|
A named, restricted location | Working files and exports live in one location named as Confidential, open only to the asset's approved role profiles or named people. | CL-06 |
Access through role profiles | Access granted only through an approved role profile, or non-standard access the owner approves with an expiry. | CL-17 |
Administrator access | Administrators of the systems that hold it use separate administrator accounts, with elevation approved and time-limited under the privileged access pack. | CL-17 |
Encryption | Encrypted at rest in every system and device that holds it; encrypted in transit on every route outside the managed systems. | CL-06 |
Labels at the source | The system's reports and exports carry the Confidential label without anyone adding it. | CL-09 |
Suppliers | Every supplier that holds it is under the contract clauses and has been assessed before it received it. | CL-16 |
AI tools | The approved AI tools for Confidential information are named, or it is recorded that there are none. | CL-19 |
Retention and holds | The retention rule is set in each system, and the records manager can apply a legal hold in each. | CL-11 |
Recorded | The register shows the location, the access, the suppliers, the retention rule and how the label is carried. | CL-01 |
Access to the asset is granted through the role profiles of the Role-Based Access Profile Matrix (P13 JML-03) or non-standard access with an expiry (P13 JML-04), and is reviewed in every access review. Administrator access follows the Privileged Access Standard (P14 PA-02, PA-06, PA-07). Any item that cannot be set up is either a plan with a date the information owner approves, or an exception under the Security Exception & Waiver Standard (CL-20).
Guidance — delete before approval
EXAMPLE: Confidential customer delivery lists stay on the six unencrypted laptops at the smaller warehouse site until the March 2027 refresh, under the conditions of the risk acceptance RA-01 (P05 R-12); the refresh brings them onto encrypted devices. That is recorded as a plan against CL-06 for IA-01, with 31 Mar 2027 as its date.
Reclassification and declassification
Reclassify when a change in purpose, content, audience, incident or contract changes the impact. Only the owner lowers a level, with the reason recorded (CL-10). These triggers start a review. Each says which way the level usually moves:
Ref | Trigger | Usually | What to do |
|---|---|---|---|
RT-01 | A new purpose, audience or recipient, including a new supplier | Either | Rate the three impacts again before the information is shared. |
RT-02 | Information combined, exported or reported in bulk | Up | Rate the combination (CL-13); a bulk export may need a higher level than its parts. |
RT-03 | Personal or special category data added | Up | Add the marker (CL-07); special category or data at scale makes it Confidential (CL-14). |
RT-04 | An incident, near miss or handling check that shows the impact was underrated | Up | Contain and report through the incident pack (CL-18), then reassess the affected asset and its copies. |
RT-05 | A change in law, regulation or a contract | Either | Check the level, the retention period and the handling rules with the privacy adviser and Legal. |
RT-06 | The owner approves public release | Down | Record the release decision (CL-05); the released version becomes Public, the working files keep their level. |
RT-07 | An embargo or announcement date passes | Down | Lower the level from that date, as the owner recorded when classifying. |
RT-08 | Information anonymised, or reduced to statistics no one can be identified from | Down | The new version is rated on its own; the source keeps its level. |
RT-09 | The commercial sensitivity lapses: a price list replaced, a contract ended, a bid decided | Down | The owner lowers the level, with the reason (CL-10), or the retention schedule ends it. |
RT-10 | The annual review | Either | Confirm the level, owner, location, markers and retention (CL-12). |
Steps
- Whoever spots the trigger tells the owner and the security role, and says what changed.
- If the change raises the harm and the information is already exposed, contain first: restrict the location or the access, then report through the incident route (CL-18).
- The owner rates the three impacts again, for the asset and for each of its exports and copies (CL-02, CL-13).
- The owner records the new level, the trigger, the reason and the date in the register (CL-10).
- The custodian changes the labels, the location and the access to match, and tells the people who use it.
- Copies already shared keep their old label until they are replaced; the owner decides whether any must be recalled or deleted.
- The owner sets the next review date.
Lowering a level
Only the owner lowers a level, with the reason and date recorded. Confidential becomes Public only through a release decision (CL-05). A lower level applies to the new version and its future copies; copies already shared keep the label they carry until replaced.
The commonest lowering is planned at the start: a price list due to be announced, a result before its publication date, a bid before it is decided (RT-07, RT-09). Record the date and the new level when classifying, so the change does not depend on anyone remembering.
Guidance — delete before approval
A review after a material change is due within [[15]] working days of the change, whatever the annual date says. In the EXAMPLE, the warehouse shift rotas moved into a new system on 7 Sep 2026; the review fell due on 28 Sep 2026 and was missed, which is the one late review in ICM-02.
Handling checks
Each quarter the Head of Information Security checks a sample of [[5]] Confidential assets where they are actually held: who can reach them, how they are labelled and shared, and whether exports exist the register does not show. The check looks at where information actually is, not at what the register says.
Step | What to do |
|---|---|
1 | Choose the sample from the register: Confidential assets first, with at least one that has a regular export and one held by a supplier. |
2 | For each, open the systems and locations where it is actually held, with the custodian. |
3 | Compare who can reach it with the access the register shows; list anyone else. |
4 | Look for copies and exports the register does not show: team sites, shared drives, email attachments, reports. |
5 | Check the labels on a sample of files, messages and prints against the level. |
6 | Check how it was last shared outside the organisation, and by which channel. |
7 | Record what was found, and agree each action with the owner, with a due date. |
What a finding leads to
Finding | Action |
|---|---|
Everything as the register shows | Record the check and its date. No action. |
A copy or export the register does not show | The owner rates it (CL-13); it is recorded in the register as part of the asset or as an asset of its own. |
Confidential information open to people without access | Restrict it at once; report through the incident route (CL-18); check the access log for who opened it. |
A label missing or lower than the level | Correct the label; set the label at the source where the system allows (CL-09). |
The level looks wrong | The owner reassesses it (RT-04) and records the reason for the new level, or for keeping it. |
A rule cannot be met for a good reason | A plan with a date, or an exception under the exception process (CL-20). |
Guidance — delete before approval
Choose at least one asset each quarter that was not checked before, and one with a regular export. The first handling check usually finds the export nobody listed.
Retention, legal holds and disposal
Every asset in the register names its retention rule from the schedule. Personal data is kept no longer than its purpose needs (GDPR storage limitation). At the end of the period it is deleted or disposed of by the level's rule, unless a legal hold applies.
Legal holds
A legal hold overrides the schedule: nothing under hold is deleted, changed or disposed of until Legal releases the hold in writing (CL-15). The records manager applies the hold in each system and tells the custodians and the disposal provider.
The records manager keeps the list of holds, with what each covers, who placed it and when it is released. Before any deletion or disposal, the custodian checks the list (CL-15).
Disposing of items that held information
Every disposal follows these steps. The method for each media type is in the Secure Information Disposal Checklist.
Step | What to do | Rule |
|---|---|---|
1 | Check the register and the legal holds: nothing under hold goes (CL-15). | CL-15 |
2 | Record each item on the collection manifest: asset tag, serial number, media type, the highest level it held. | CL-11 |
3 | Remove the device from device management and the asset inventory only after step 6. | CL-11 |
4 | Sanitise in house, or hand over to an approved provider against the signed manifest. | CL-11 |
5 | Receive the certificate within [[10]] working days of collection for a provider, or complete the disposal record for in-house destruction. | CL-11 |
6 | Reconcile the certificate with the manifest, serial by serial. Every item matched closes; any item missing is chased. | CL-11 |
7 | An item not accounted for within [[10]] working days of the chase is reported as a suspected loss through the incident pack (CL-18). | CL-18 |
The three methods, as NIST Special Publication 800-88, Guidelines for Media Sanitization names them, in this pack's words:
Method | What it means |
|---|---|
Clear | Overwrite all the space a user can reach, with the device's ordinary commands, so simple recovery tools find nothing. Enough for re-use inside the organisation. |
Purge | Make recovery infeasible even in a laboratory: the device's built-in sanitise or secure-erase command, degaussing a magnetic medium, or cryptographic erase where the device was encrypted from first use. Required before a medium leaves the organisation's control. |
Destroy | Make the medium unusable and recovery infeasible: shredding, disintegration or incineration by a specialist provider, or in house with equipment rated for the medium. Required where a medium cannot be purged or has failed. |
Checking a certificate
A certificate is checked against the collection manifest, serial by serial, on the day it arrives. It must show:
- Provider's name and certificate number
- Collection reference, matching the organisation's collection manifest
- Each item's asset tag and serial number
- Media type of each item
- Method for each item: Clear, Purge or Destroy, and the tool or process used
- Verification done, and its result
- Date of sanitisation or destruction, and the site
- Name and signature of the person responsible
A certificate that lacks a field is sent back. An item on the manifest and missing from the certificate is chased the next working day; if it is not accounted for within [[10]] working days of the chase, it is reported as a suspected loss through the incident route (CL-18).
Reporting mishandling
Report mishandling at once, through the incident reporting route (P09 IM-01). Nobody is blamed for a report made in good faith. Report, for example:
- Confidential information sent to the wrong person, or to the right person by an unapproved channel
- A device, paper file or removable medium holding Internal or Confidential information lost or stolen
- Confidential information found unlabelled, labelled lower than its level, or in a location open to people without access
- Confidential information put into an AI tool not approved for it
- A disposal certificate that does not account for every item
What the person who finds it does first
- Stop it going further: do not forward it, and recall or unshare it if the system lets you.
- Do not delete anything, and do not contact the recipient unless the incident manager asks you to.
- Report it at once through the incident reporting route, saying what was sent or exposed, to whom, when, and its level.
- Write down what you remember while it is fresh: the time, the address, the file name.
Where personal data may be involved, the incident pack's reporting screen decides whether it is a personal data breach, and its GDPR duties apply (RD-06, RD-07, RD-08, RD-09), with the Data Protection Officer advising. Its Personal Data Breach Response Playbook sets every step and clock; this pack restates none of them.
Once contained, the owner reassesses the asset and its copies (RT-04), and the root cause goes into the handling checks.
Guidance — delete before approval
This procedure stops at the report. Triage, severity, containment and every reporting duty are the incident pack's (Incident Triage & First-Hour Assessment Procedure; Personal Data Breach Response Playbook); its clocks are not repeated here, so they cannot drift.
Outputs and records
Output | Produced at | Held in |
|---|---|---|
Register entry: asset, owner, custodian, where held, exports | Step 1 | Information Asset Register |
Three ratings, with impact levels and reasons | Steps 2 and 3 | Information Asset Classification Workbook; Information Asset Register |
Level, markers, approval and reason | Steps 4 to 6 | Information Asset Register |
Labels and Confidential setup confirmed | Step 7; the Confidential setup | Information Asset Register, with the custodian's confirmation |
Next review date | Step 8 | Information Asset Register |
Reclassification record: trigger, reason, date, owner | Reclassification | Information Asset Register |
Handling check record and actions | Handling checks | [[Handling check file]]; actions in Information Asset Register |
Legal hold list | Legal holds | [[Records manager's hold list]] |
Collection manifest, certificate and reconciliation | Disposal | Secure Information Disposal Checklist |
Incident report | Reporting mishandling | The incident pack's Incident Case & Action Log |
Timing targets
Activity | Target | Basis |
|---|---|---|
New asset classified | Before it is first used, shared or retained | CL-01 |
Review after a material change | Within [[15]] working days of the change | CL-03 |
Review of every classification | At least every [[12]] months | CL-12 |
Handling check | Each quarter | CL-06, CL-12 |
Certificate from a provider | Within [[10]] working days of collection | CL-11 |
Certificate reconciled with the manifest | The day it arrives | CL-11 |
Missing item chased | The next working day | CL-11 |
Missing item accounted for, or reported as a loss | Within [[10]] working days of the chase | CL-11, CL-18 |
Mishandling reported | At once | CL-18 |
Disagreement and escalation
If the information owner and the Head of Information Security disagree about a level, the higher level applies until the owner's line manager decides, and both views are recorded. If an asset has no owner, the Head of Information Security names the head of the function it serves as owner until a decision is recorded, and the asset is Internal meanwhile (CL-04). A handling rule that cannot be met goes to the Security Exception & Waiver Standard as an exception (CL-20); it is never met by lowering the level.
Worked example: the price export
EXAMPLE, not part of the procedure. The organisation is the one used throughout the pack: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders. IA-02, customer price lists and discount terms, owned by the Sales Director.
Date | What happened | Who |
|---|---|---|
19 Aug 2026 | First rated: confidentiality Medium (Moderate), integrity Medium (Moderate), availability Medium (Moderate). Internal: the highest impact is Medium (CL-02). | Sales Director |
17 Sep 2026 | Handling check. The monthly export of every customer's prices and discounts was saved on a sales team site that all 900 staff could open, labelled Internal. Each customer receives its own price list, so confidentiality and integrity had been rated Medium for one list, not for every list together. | Head of Information Security, in the quarterly handling check |
17 Sep 2026 | Re-rated for the combination (CL-13, RT-02): confidentiality High (Major), integrity High (Major), availability Medium (Moderate). Confidential: an impact is High (CL-02). | Sales Director |
18 Sep 2026 | Move the export to a Confidential location open only to the sales account manager profile (RP-06, 40 sales account managers). | Head of IT |
23 Sep 2026 | Check the site's access log for opening of the export by anyone outside that profile since it was first saved there. Opened by 3 people outside sales, all in finance, for invoicing queries; no sign it left the organisation, so no incident was declared. | Head of Information Security |
Due 31 Oct 2026 | Label the ERP's price list report Confidential at the source, so every export carries it (CL-09). Open at quarter end. | Head of IT |
The first rating was of one customer's price list, which goes to that customer. Combined, the prices would let a competitor undercut every bid, so confidentiality and integrity rose. Under CL-18 a finding like this is reported through the incident route; the access log check showed nothing had left the organisation, so no incident was declared. (EXAMPLE)
Guidance — delete before approval
What this example teaches: rate the export, not only the system. The ERP holds the prices behind role profiles; the risk was the monthly spreadsheet, which nobody had listed.
Worked example: the order history sent to the wrong customer
EXAMPLE. INC-2026-016: customer order spreadsheet sent to the wrong business customer. A customer service agent emailed a spreadsheet of 212 customers' names, delivery addresses and order histories to the wrong business customer. The recipient confirmed in writing the same day that it had deleted the file. No payment data was included.
What the procedure required | What happened |
|---|---|
The export of IA-01 (Confidential, Personal data marker) labelled Confidential (CL-09) | Saved without a label. |
Shared outside the organisation only to an approved recipient, by an expiring encrypted link, with the address checked against a trusted record (CL-08) | Sent as an ordinary attachment, with the address picked from autocomplete. |
Reported at once through the incident route (CL-18) | Self-reported by the agent on 9 Sep 2026 at 11:05. |
Personal data: the incident pack's GDPR route | Personal data breach (confidentiality): a risk to individuals, so notified to the supervisory authority; not a high risk once the recipient confirmed deletion, so individuals were not told. Notified under RD-06, on time. |
Reassess the asset and its copies once contained (RT-04) | The level was right; the export route was not. Actions below. |
Action | Owner | Due | Source |
|---|---|---|---|
Customer service exports of the order history go only to a Confidential export folder, labelled at the source, and are deleted after [[30]] days | Head of IT | 31 Oct 2026 | HA-01, this pack |
Brief every customer service agent on sharing Confidential information outside the organisation, with the quick-reference card | Head of Information Security | 16 Oct 2026 | HA-02, this pack |
Turn on the warning for external recipients in email, and stop address autocomplete for customer service | Head of IT | 15 Oct 2026 | PIA-06, the incident pack's review |
It is the quarter's one mislabelled or mishandled information incident (ICM-03). (EXAMPLE)
Worked example: a certificate one laptop short
EXAMPLE. DS-2026-10: head office laptop refresh: 24 retired laptops with encrypted solid-state drives. Method: Purge. Provider: IT asset disposal provider (DP-1), Tier 2 under the third-party pack's criteria, certificate per item, by serial number.
Date | What happened | Against the procedure |
|---|---|---|
12 Aug 2026 | Legal hold LH-2026-01 in force on evidence of the ransomware incident INC-2026-014: the images of the 14 Warehouse 2 office PCs taken before they were rebuilt, and the incident's logs. | The hold covers Warehouse 2 office PCs; the 24 head office laptops are not under it (step 1). |
8 Sep 2026 | 24 laptops collected against the signed manifest. | Steps 2 to 4 |
21 Sep 2026 | Certificate received: 23 of 24 serials. | 9 working days after collection (limit [[10]]): on time. Reconciled the same day; LT-0417 missing (steps 5, 6). |
22 Sep 2026 | LT-0417 chased. The provider says the laptop is in its quarantine queue and has not been processed; a certificate is promised. | The next working day (step 6) |
6 Oct 2026 | Deadline: LT-0417 accounted for, or reported as a suspected loss of an encrypted device. | [[10]] working days after the chase (step 7) |
At 30 Sep 2026 the quarter's disposals account for 28 of 29 items (ICM-04), outside tolerance, because every item must be accounted for. The laptop's drive is encrypted, which the incident pack's assessment takes into account if it has to be reported as a loss. (EXAMPLE)
Related documents
Document | Relationship |
|---|---|
Information Classification & Handling Policy | The levels, markers and rules this procedure carries out |
Classification Level Handling Rules Matrix | The handling rule for every action at every level (step 7; the Confidential setup) |
Information Asset Register | Where every decision, review and reclassification is recorded |
Information Asset Classification Workbook | The impact criteria and the rating worksheet (steps 2 to 4) |
Secure Information Disposal Checklist | The disposal method by media type, the manifest and the certificate reconciliation |
Classification Quick-Reference Card & Staff Briefing | What staff are told about labels, unlabelled information and reporting |
Information Ownership Responsibility Matrix | Who is responsible, accountable, consulted and informed for each activity |
Role-Based Access Profile Matrix; Privileged Access Standard | Access to Confidential information and to the systems that hold it |
Supplier Contract Security Clause Library; Supplier Security Risk Register | Suppliers that hold information: clauses, tier and assessment |
Incident Triage & First-Hour Assessment Procedure; Personal Data Breach Response Playbook | What happens after mishandling is reported |
Security Exception & Waiver Standard | Exceptions to the rules |
Adapting this template
Guidance — delete before approval
Small organisation: classify the ten assets that matter most in one sitting with the managing director, using the workbook. Keep steps 1 to 8, the unlabelled rule and the certificate check; drop the quarterly handling check to twice a year if you have fewer than [[20]] Confidential assets, but always check exports.
Regulated entity: NIS2's Implementing Regulation (EU) 2024/2690 asks for periodic review of the levels (Annex, point 12.1.3) and for a handling policy communicated to everyone (point 12.2.1); the review dates and the labels are the evidence. A DORA financial entity sets secure deletion and the disposal of storage devices holding confidential information in its data security procedure (Delegated Regulation (EU) 2024/1774, Article 11(2)(g) and (h)); name this procedure and the disposal checklist as that process.
IT run by a service provider: the provider is the custodian for most systems. Put the label setup, the Confidential setup, the hold check and the certificate window into its contract, and ask it to confirm each item in writing. The decision on the level stays with your information owner.
Delete this section before approval.
Framework references
These references show where this document supports an external framework. They indicate relevance only and do not reproduce the text of any standard. ISO/IEC 27001 references name the clause or control this document relates to. They do not say that meeting it meets any other framework's requirement. Editions referenced: ISO/IEC 27001:2022 incl. Amd 1:2024; NIST CSF 2.0; Directive (EU) 2022/2555 (NIS2) and Implementing Regulation (EU) 2024/2690; Regulation (EU) 2016/679 (GDPR); Regulation (EU) 2022/2554 (DORA) and Delegated Regulation (EU) 2024/1774.
Framework | Reference | Supported by |
|---|---|---|
ISO/IEC 27001:2022 | Annex A 5.13 — Labelling of information | Labelling by medium; setting labels up in systems; copies, exports and prints |
ISO/IEC 27001:2022 | Annex A 5.12 — Classification of information | Classifying an information asset; reclassification |
ISO/IEC 27001:2022 | Annex A 5.14 — Information transfer | Sharing outside the organisation in the worked example; the Confidential setup |
ISO/IEC 27001:2022 | Annex A 5.33 — Protection of records | Retention and legal holds |
ISO/IEC 27001:2022 | Annex A 7.14 — Secure disposal or re-use of equipment | Disposing of items that held information; checking a certificate |
ISO/IEC 27001:2022 | Annex A 8.10 — Information deletion | Deletion at the end of retention; disposal steps |
NIST CSF 2.0 | ID.AM-05 — “Assets are prioritized based on classification, criticality, resources, and impact on the mission” | Classifying an information asset: the decision made and recorded |
NIST CSF 2.0 | ID.AM-08 — “Systems, hardware, software, services, and data are managed throughout their life cycles” | Retention, legal holds and disposal: the end of the life cycle |
NIST CSF 2.0 | PR.DS-02 — “The confidentiality, integrity, and availability of data-in-transit are protected” | The Confidential setup: encryption in transit; sharing by an approved channel |
NIS2 — Directive (EU) 2022/2555 | Article 21(2)(i) — “human resources security, access control policies and asset management” | Whole procedure |
NIS2 — Implementing Regulation (EU) 2024/2690 | Article 1 — lays down the technical and methodological requirements of the Article 21(2) measures, and further specifies when an incident is significant, for DNS service providers, TLD name registries, cloud computing, data centre and content delivery network providers, managed service and managed security service providers, providers of online marketplaces, online search engines and social networking services platforms, and trust service providers | Regulated-entity tailoring: the entities the Implementing Regulation binds |
NIS2 — Implementing Regulation (EU) 2024/2690 | Annex, point 12.1.2 — the relevant entities shall “(a) lay down a system of classification levels for assets; (b) associate all assets with a classification level, based on confidentiality, integrity, authenticity and availability requirements, to indicate the protection required according to their sensitivity, criticality, risk and business value; (c) align the availability requirements of the assets with the delivery and recovery objectives set out in their business continuity and disaster recovery plans.” | Classifying an information asset from confidentiality, integrity and availability |
NIS2 — Implementing Regulation (EU) 2024/2690 | Annex, point 12.1.3 — “The relevant entities shall conduct periodic reviews of the classification levels of assets and update them, where appropriate.” | Reclassification; the annual review |
NIS2 — Implementing Regulation (EU) 2024/2690 | Annex, point 12.2.1 — “The relevant entities shall establish, implement and apply a policy for the proper handling of assets, including information, in accordance with their network and information security policy, and shall communicate the policy on proper handling of assets to anyone who uses or handles assets.” | Labelling by medium: the handling made visible to everyone |
NIS2 — Implementing Regulation (EU) 2024/2690 | Annex, point 12.2.2 — the policy shall “(a) cover the entire life cycle of the assets, including acquisition, use, storage, transportation and disposal; (b) provide rules on the safe use, safe storage, safe transport, and the irretrievable deletion and destruction of the assets; (c) provide that the transfer shall take place in a secure manner, in accordance with the type of asset to be transferred.” | Retention, legal holds and disposal: irretrievable deletion and destruction |
DORA — Regulation (EU) 2022/2554 | Article 8(1) — identify, classify and document ICT-supported business functions, information assets and ICT assets, reviewed at least yearly | Classifying an information asset; regulated-entity tailoring |
DORA — Delegated Regulation (EU) 2024/1774 | Article 11(2)(g) — “the process to securely delete data, present on premises of the financial entity or stored externally, that the financial entity no longer needs to collect or to store” | Deletion of data no longer needed; regulated-entity tailoring |
DORA — Delegated Regulation (EU) 2024/1774 | Article 11(2)(h) — “the process to securely dispose or decommission of data storage devices present on premises of the financial entity or stored externally containing confidential information” | Disposal of storage devices holding confidential information; regulated-entity tailoring |
GDPR — Regulation (EU) 2016/679 | Article 5(1)(f) — personal data shall be “processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’)” | Adding markers: the Personal data marker |
GDPR — Regulation (EU) 2016/679 | Article 4(12) — “personal data breach” means “a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed” | Reporting mishandling: what makes it a personal data breach |
GDPR — Regulation (EU) 2016/679 | Article 33(1) — notify the supervisory authority “without undue delay and, where feasible, not later than 72 hours after having become aware of it”, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons; a later notification gives reasons for the delay | Reporting mishandling: the incident pack's GDPR route, without its clocks |
Definitions
Term | Meaning in this procedure |
|---|---|
Information asset | A body of information managed as one unit, with one owner and one purpose, such as the customer accounts and order history. Its copies, exports and extracts are part of it unless the owner records them as an asset of their own. |
Classification | The owner's decision on how much protection an information asset needs, made from the harm that unauthorised disclosure, unauthorised change or loss of availability could cause. |
Impact rating | Low, Medium or High: the harm one of confidentiality, integrity or availability could suffer, read from the risk scale's impact levels (Low is Minor, Medium is Moderate, High is Major or Severe). |
Aggregation | Combining information so that the whole could cause more harm than any part: every customer's prices in one file, or a rota joined to absence reasons. |
Marker | A word added to the level where a law or a duty adds rules of its own: Personal data, Special category or Legal hold. A marker never lowers a level. |
Label | The visible sign of the level on the information itself: a subject-line tag, a header, a sensitivity label, a stamp or a spoken warning. |
Handling rule | What the level requires for one action, such as storing, sharing, printing or disposing of the information. |
Handling check | The quarterly check of a sample of Confidential assets where they are actually held: access, labels, exports and sharing. |
Material change | A change that makes a review due within [[15]] working days: a new system, location or regular export; a new supplier, or a change in what a supplier does with it; a new purpose or audience; personal or special category data added; an incident involving it; a change in law or contract. |
Reclassify | To change the level after a change in purpose, content, audience, law, contract or after an incident, with the reason recorded. |
Declassify | To lower a level. Only the owner does it, with a recorded reason. |
Release | The owner's recorded decision that information may be given to anyone. Only release makes information Public. |
Legal hold | An instruction from Legal to keep named information unchanged, whatever its retention period, because of a claim, an investigation or an authority's request. |
Collection manifest | The organisation's list of items handed to a disposal provider: asset tag, serial number, media type and the highest level each held, signed at collection. |
Certificate | A provider's signed record that named items, listed by serial number, were sanitised or destroyed, by which method, when and by whom. |
Sanitise | To make information on a medium impossible to recover, by one of the three methods of NIST Special Publication 800-88 (Guidelines for Media Sanitization): clear, purge or destroy. |
Mishandling | Handling information against its level's rule: sending it to the wrong person, storing it in the wrong place, losing it, leaving it unattended, or labelling it lower than its level. |