Classification Level Handling Rules Matrix

States what each level permits for storage, sharing, transfer, printing, retention and disposal.

Available soon

Format: Excel
Size: 68 KB
Length: 11 sheets
Version: 2.0
Updated: 1 Oct 2026

Follow this documentFree account. We can email you when it changes.

What changed

2.01 Oct 2026
Rewritten to the depth of the other CISO Times packs: the 10 actions at each of the 3 levels, with the rules each applies and the other packs it relies on; the levels, the three markers and the rules on one sheet; labelling for 8 media; and a lookup that gives the rule, the label and the marker rules for any piece of information, checked for special category data and legal holds, with the distributor's worked example.
1.01 Oct 2026
Published.

Changes across this pack

Preview

The workbook's sheets as you will receive them, with its example rows and the values its formulas calculate. Highlighted [[text]] is for you to replace; rows marked EXAMPLE are for you to delete. Wide sheets scroll sideways. The cover, document control and changelog sheets are in the file.

Instructions

How to use this workbook

Step	What to do
1	Read Levels and markers first: the 3 levels, what each means and when it applies. Internal is the default for new business information until its owner decides (CL-04), and only an owner's release decision makes information Public (CL-05). The level comes from the Information Asset Classification Workbook; this matrix says what the level requires.
2	Tailor the Handling matrix: one row per action, one column per level. Replace every [[placeholder]], such as the list of approved AI tools. You may make a rule stricter; a looser rule changes the Information Classification & Handling Policy and is approved at its tier. Keep the 10 actions, so the policy, the procedure and the staff briefing still point at the same rows.
3	Tailor Labelling by medium to the systems you have: where a system can carry a sensitivity label, name it. Treat unlabelled business information as Internal (CL-04). Never treat it as Public (CL-05). If it is obviously more sensitive, such as personal data at scale or prices, treat it as Confidential, ask the owner, and report it if it was in the wrong place (CL-18).
4	Markers add rules to a level; they never lower it (CL-07, CL-14, CL-15). Apply every marker that fits: personal data at any level, special category data always at Confidential, a legal hold until Legal releases it.
5	To answer "what do I do with this?", use the Handling lookup: enter the information, choose its level, mark the markers that apply, and choose the action and the medium. The rule, the label and the marker rules appear; the Check column stops a special category item below Confidential, in an AI tool, or under a legal hold being deleted.
6	Approve the matrix at the Standard tier: Head of Information Security (the document owner is consulted), reviewed at least every 12 months and whenever the policy, a law or a contract changes a rule. Any departure from these rules is a P02 exception, scored and approved by the approver its band sets (EX-05); a Critical exception is approved by the board or its equivalent.
7	Delete the EXAMPLE rows on the Handling lookup before approval. The Levels and markers, Handling matrix and Labelling by medium sheets are the content itself: tailor them, do not delete them.

Legend

Yellow cells are inputs. Everything else is calculated or fixed — do not overwrite formulas.

EXAMPLE

Rows marked EXAMPLE in the first column show how a completed row looks. Delete them before approval.

EXAMPLE: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders, an important entity under NIS2 in its Member State. The lookup shows its own information: the monthly export of every customer's prices, re-rated Confidential in September and moved to a restricted location; the order history export that went to the wrong business customer; the delivery lists on unencrypted laptops it keeps until March 2027 under a risk acceptance (CL-06); and sickness notes someone wanted to summarise with an AI tool.

Tailoring for a small organisation: keep the three levels and the ten actions, and shorten the cells to what your tools allow. If you have no secure print release, say "collect at once" and keep Confidential printing to a minimum.

Tailoring for a regulated entity: NIS2's Implementing Regulation (EU) 2024/2690 expects rules for the safe use, storage, transport and deletion of assets (Annex 12.2.2), and protection of removable media (12.3.2); a DORA financial entity's data security procedure sets access restrictions for each classification level (Delegated Regulation (EU) 2024/1774 Article 11(2)(a)). This matrix is the place to show both.

Tailoring where a service provider runs your IT: the custodian is often the provider. Give it this matrix as part of its contract, and check its storage, encryption and disposal against the Confidential column at its next assessment.

Levels and markers

The levels, the markers and the rules the matrix applies

The level is the owner's decision, from the harm that disclosure, change or loss could cause (CL-02). Internal is the default; Public needs a release decision. Markers add rules and never lower a level.

Levels

Level	Meaning	Use it when	Label	Examples	Default
Public	Approved for public release. No confidentiality restriction remains.	The owner has approved release to anyone, and every impact is Low.	None needed; "Public" where it helps a reader.	Published product catalogue and website pages; Press releases and the published annual report; Job advertisements once published	No
Internal	For the organisation and approved suppliers. Unauthorised disclosure could cause limited harm.	The highest impact is Medium, or every impact is Low but release has not been approved. All new business information starts here.	"Internal" where the medium supports it. Unlabelled business information is treated as Internal.	Policies and procedures; Warehouse stock levels and dispatch plans; Sales forecasts and marketing plans; Shift rotas (with the Personal data marker)	Yes: new information starts here (CL-04)
Confidential	Restricted to named roles or recipients. Unauthorised disclosure, change or loss could cause material harm.	Any of confidentiality, integrity or availability is rated High.	"Confidential" always, on every page, file, message and copy.	Customer accounts, order history and price lists; Payroll, staff bank details and HR records; Supplier bank details; Board papers	No

Markers

Marker	Applies to	What it adds
Personal data	Any personal data, at any level.	Data protection law applies whatever the level (CL-07): a lawful basis, purpose limits, retention no longer than necessary, the GDPR breach route through the incident pack (CL-18), and processor terms for any supplier that processes it (P06 clause CL-06).
Special category	Special category personal data (GDPR Article 9), always with the Confidential level.	Access by named people only; never printed outside the office, taken on removable media or put into an AI tool; the Data Protection Officer consulted before any new use or sharing.
Legal hold	Information Legal has placed under a hold, at any level.	Not changed, deleted or disposed of until Legal releases the hold in writing, whatever the retention schedule says (CL-15).

The rules this matrix applies, from the Information Classification & Handling Policy

Rule	What it says
CL-01	Classify information, and the system or medium that holds it, before it is used, shared or retained. A system or medium takes the highest level of the information it holds.
CL-04	The default for new business information is Internal until its owner records a different decision. Information whose classification is incomplete is handled as Internal.
CL-05	Public information must have an owner-approved release decision. A lack of a label never makes information Public.
CL-06	Apply the handling rule for the level to every action: storing, accessing, sharing inside and outside the organisation, transferring, printing, remote and mobile working, AI tools, retaining and disposing.
CL-07	Personal data is protected under data protection law (GDPR) regardless of the classification label, and carries the Personal data marker. The label does not decide whether processing is lawful.
CL-08	Confidential information is shared only with an approved recipient for a recorded purpose, using an approved channel, with the recipient's address checked before sending.
CL-09	Use a visible label where the medium supports it, and carry the level into exports, copies, prints and meeting materials. Confidential is always labelled.
CL-11	Dispose of information and media using the level's disposal rule and the method for the media type. Keep a certificate for every Confidential item a provider sanitises or destroys, due within [[10]] working days of collection, and a disposal record for every item destroyed in house.
CL-13	A collection, export, report or copy takes the highest level of anything in it, and a higher level where combining the items raises the impact.
CL-14	Special category personal data, and personal or customer data at scale, are always Confidential, and carry the Personal data and, where it applies, the Special category marker.
CL-15	Information under a legal hold is not changed, deleted or disposed of, whatever its retention period, until Legal releases the hold in writing. Disposal checks for a hold first.
CL-16	A supplier stores, processes or receives Internal or Confidential information only under contract terms that protect it (P06 clause CL-01, P06 clause CL-07, P06 clause CL-13, and P06 clause CL-06 where it processes personal data). Confidential information goes to a supplier only after its assessment under the third-party pack has ended in a documented decision to approve it (P06 TP-05).
CL-17	Access to Confidential information is granted only through an approved role profile or approved non-standard access with an expiry (P13 JML-03, JML-04), is reviewed in every access review (P07 AR-02), and administrator access to systems that hold it follows the privileged access pack (P14 PA-02, PA-06, PA-07).
CL-18	Suspected mishandling, loss, or Confidential information found unlabelled or in the wrong place is reported at once through the incident reporting route (P09 IM-01). A suspected personal data breach follows the incident pack's GDPR reporting duties (RD-06 to RD-09).
CL-19	Information goes into an AI tool only where the tool is approved for its level: Public into any tool; Internal and Confidential only into tools the organisation has approved for that level, under a contract that bars using its data to train models. Special category data never.
CL-20	Any departure from these rules is a P02 exception, scored and approved by the approver its band sets (EX-05); a Critical exception is approved by the board or its equivalent. The headline measures go monthly to the security and IT leadership team.

P06 clause CL-nn is a contract clause of the third-party pack, never one of these rules.

Handling matrix

What each level requires for each action (CL-06). Read across for an action, down for a level. Yellow cells are yours to tailor; the Confidential column names the rules of other packs it relies on.

Action	Rules	Public	Internal	Confidential
Store	CL-01, CL-06	The approved public location, with the master copy in managed storage so the published copy can be checked and restored.	Managed organisation storage with access control: the organisation's business systems, file storage and email. Not in personal accounts or on unmanaged devices.	Managed storage that encrypts at rest, in a location limited to named people or approved role profiles. Never in personal accounts, on unmanaged devices, or on removable media without the owner's approval and encryption.
Access	CL-17	Anyone, once released.	Staff and approved suppliers with a business need, through the base profile and role profiles (P13 JML-03).	Named people or an approved role profile (P13 JML-03), or non-standard access the owner approves with an expiry (P13 JML-04). Reviewed in every access review (P07 AR-02). Administrator access to the systems that hold it follows the privileged access pack (P14 PA-02, PA-06, PA-07).
Share internally	CL-08, CL-13	No restriction.	With colleagues who need it, by a link to the managed location rather than a copy where practical.	Only with people who already hold access, for the recorded purpose, by a link to the managed location. No forwarding of copies, and no copying into another location without the owner's approval.
Share externally	CL-08, CL-16	The released version only.	With approved suppliers and partners that have a business need, under a contract with confidentiality terms (P06 clause CL-01). Check the recipient's address before sending.	Only to a recipient the owner has approved for the recorded purpose, under a contract or confidentiality agreement; to a supplier only after its assessment has approved it (P06 TP-05) and under P06 clause CL-01, P06 clause CL-07 and, for personal data, P06 clause CL-06. By an encrypted, expiring share link or an encrypted file, with the address checked against a trusted record, never typed from memory or picked from autocomplete.
Transfer	CL-06	Any method.	Approved managed routes: organisation email, managed file sharing or the business system's own exchange. Removable media only if encrypted.	Encrypted on every route outside the organisation's managed systems. Removable media only when the owner approves, encrypted and logged. Paper by hand or by tracked, sealed post.
Print	CL-06, CL-09	No restriction.	Only when needed; collect at once, using secure print release where the printer has it.	Only when necessary, through secure print release, labelled on every page. Never left on a printer or desk; every copy shredded when no longer needed.
Remote and mobile working	CL-06	No restriction.	On managed devices or the organisation's managed apps; screen locked when away.	Only on managed, encrypted devices. Not printed at home, not worked on where it can be overlooked or overheard, and not discussed on speaker in shared spaces.
AI tools	CL-19	Any tool.	Only AI tools the organisation has approved for Internal [[list]], signed in with the work account, under a contract that bars using its data to train models.	Only AI tools the organisation has approved for Confidential [[list, which may be none]], under a contract assessed under the third-party pack that bars using its data to train models. Never a personal or free tool. Special category data never.
Retain	CL-11, CL-15	Keep while useful; the owner decides.	Use the business retention schedule.	Use the approved retention rule; personal data no longer than its purpose needs. A legal hold overrides deletion.
Dispose	CL-11, CL-15	Delete when no longer needed.	Secure deletion from managed storage; media cleared or purged by the media method; paper shredded or put in the confidential waste console.	Secure deletion or sanitisation: media purged or destroyed by the media method; retain a certificate or disposal record for every item. Check for a legal hold first.

Labelling by medium

How each medium carries the level (CL-09). Confidential is always labelled, on the source and on every copy, export and print.

Medium	Public	Internal	Confidential
Email	No label needed.	The default sensitivity label, where the email system has labels.	"CONFIDENTIAL" at the start of the subject line, and the Confidential sensitivity label where the system has one.
Documents and spreadsheets	No label needed.	"Internal" in the footer, or the default sensitivity label.	"Confidential" in the header and footer of every page, and in the document's properties or sensitivity label.
Files, folders and team sites	The public location only.	The site's or folder's default label.	A location named and restricted as Confidential; every file in it labelled, and exports labelled when they leave it.
Business systems and databases	Not applicable.	Recorded in the register.	Recorded in the register; a sign-in notice where the system allows; reports and exports carry the label.
Paper	No label needed.	"Internal" in the footer.	"Confidential" at the top and bottom of every page, and a cover sheet when it leaves the office.
Meetings and recordings	No label needed.	No label needed.	The invitation and agenda say Confidential; the chair says so at the start; recorded only with the owner's approval, and the recording labelled.
Conversations and calls	No warning needed.	No warning needed.	Say it is Confidential before sharing it, and check who can hear.
Devices and removable media	No label needed.	Asset tag only.	Encrypted; labelled with the level and the owner on the device or its case.

No label? Treat unlabelled business information as Internal (CL-04). Never treat it as Public (CL-05). If it is obviously more sensitive, such as personal data at scale or prices, treat it as Confidential, ask the owner, and report it if it was in the wrong place (CL-18).

Handling lookup

What do I do with this? Enter the information, its level and markers, the action and the medium. Yellow cells are yours; the rule, label and marker rules come from the sheets before this one.

Example	Information	Asset ID	Level	Personal data?	Special category?	Legal hold?	Action	Medium	Handling rule (calc)	Label on this medium (calc)	The markers add (calc)	Rules (calc)	Check (calc)
EXAMPLE	The monthly export of every customer's prices, moved to its Confidential location	IA-02	Confidential	No	No	No	Share internally	Files, folders and team sites	Only with people who already hold access, for the recorded purpose, by a link to the managed location. No forwarding of copies, and no copying into another location without the owner's approval.	A location named and restricted as Confidential; every file in it labelled, and exports labelled when they leave it.		CL-08, CL-13	OK
EXAMPLE	An export of a business customer's order history, requested by that customer (the case of INC-2026-016)	IA-01	Confidential	Yes	No	No	Share externally	Email	Only to a recipient the owner has approved for the recorded purpose, under a contract or confidentiality agreement; to a supplier only after its assessment has approved it (P06 TP-05) and under P06 clause CL-01, P06 clause CL-07 and, for personal data, P06 clause CL-06. By an encrypted, expiring share link or an encrypted file, with the address checked against a trusted record, never typed from memory or picked from autocomplete.	"CONFIDENTIAL" at the start of the subject line, and the Confidential sensitivity label where the system has one.	Personal data: Data protection law applies whatever the level (CL-07): a lawful basis, purpose limits, retention no longer than necessary, the GDPR breach route through the incident pack (CL-18), and processor terms for any supplier that processes it (P06 clause CL-06).	CL-08, CL-16	OK
EXAMPLE	Customer delivery lists on the smaller warehouse site's laptops, until the March 2027 refresh	IA-01	Confidential	Yes	No	No	Remote and mobile working	Devices and removable media	Only on managed, encrypted devices. Not printed at home, not worked on where it can be overlooked or overheard, and not discussed on speaker in shared spaces.	Encrypted; labelled with the level and the owner on the device or its case.	Personal data: Data protection law applies whatever the level (CL-07): a lawful basis, purpose limits, retention no longer than necessary, the GDPR breach route through the incident pack (CL-18), and processor terms for any supplier that processes it (P06 clause CL-06).	CL-06	OK
EXAMPLE	The monthly payroll file for the payroll bureau	IA-04	Confidential	Yes	No	No	Transfer	Files, folders and team sites	Encrypted on every route outside the organisation's managed systems. Removable media only when the owner approves, encrypted and logged. Paper by hand or by tracked, sealed post.	A location named and restricted as Confidential; every file in it labelled, and exports labelled when they leave it.	Personal data: Data protection law applies whatever the level (CL-07): a lawful basis, purpose limits, retention no longer than necessary, the GDPR breach route through the incident pack (CL-18), and processor terms for any supplier that processes it (P06 clause CL-06).	CL-06	OK
EXAMPLE	Board papers for the next meeting	IA-07	Confidential	No	No	No	Print	Paper	Only when necessary, through secure print release, labelled on every page. Never left on a printer or desk; every copy shredded when no longer needed.	"Confidential" at the top and bottom of every page, and a cover sheet when it leaves the office.		CL-06, CL-09	OK
EXAMPLE	Sickness absence notes, to be summarised for a return-to-work meeting	IA-05	Confidential	Yes	Yes	No	AI tools	Documents and spreadsheets	Only AI tools the organisation has approved for Confidential [[list, which may be none]], under a contract assessed under the third-party pack that bars using its data to train models. Never a personal or free tool. Special category data never.	"Confidential" in the header and footer of every page, and in the document's properties or sensitivity label.	Personal data: Data protection law applies whatever the level (CL-07): a lawful basis, purpose limits, retention no longer than necessary, the GDPR breach route through the incident pack (CL-18), and processor terms for any supplier that processes it (P06 clause CL-06). Special category: Access by named people only; never printed outside the office, taken on removable media or put into an AI tool; the Data Protection Officer consulted before any new use or sharing.	CL-19	Special category never goes into an AI tool (CL-19)
EXAMPLE	Next week's shift rota for the warehouse notice board	IA-09	Internal	Yes	No	No	Print	Paper	Only when needed; collect at once, using secure print release where the printer has it.	"Internal" in the footer.	Personal data: Data protection law applies whatever the level (CL-07): a lawful basis, purpose limits, retention no longer than necessary, the GDPR breach route through the incident pack (CL-18), and processor terms for any supplier that processes it (P06 clause CL-06).	CL-06, CL-09	OK
EXAMPLE	Network diagrams for the managed IT provider's engineers	IA-12	Internal	No	No	No	Share externally	Documents and spreadsheets	With approved suppliers and partners that have a business need, under a contract with confidentiality terms (P06 clause CL-01). Check the recipient's address before sending.	"Internal" in the footer, or the default sensitivity label.		CL-08, CL-16	OK
EXAMPLE	Customer service scripts for the outsourced contact centre	IA-14	Internal	No	No	No	Share externally	Documents and spreadsheets	With approved suppliers and partners that have a business need, under a contract with confidentiality terms (P06 clause CL-01). Check the recipient's address before sending.	"Internal" in the footer, or the default sensitivity label.		CL-08, CL-16	OK
EXAMPLE	Last season's catalogue pages, replaced on the website	IA-15	Public	No	No	No	Dispose	Files, folders and team sites	Delete when no longer needed.	The public location only.		CL-11, CL-15	OK

Lists

Level	Action	Medium	YesNo
Public	Store	Email	Yes
Internal	Access	Documents and spreadsheets	No
Confidential	Share internally	Files, folders and team sites
	Share externally	Business systems and databases
	Transfer	Paper
	Print	Meetings and recordings
	Remote and mobile working	Conversations and calls
	AI tools	Devices and removable media

Retain

Dispose

Definitions

Definitions

Term	Meaning in this workbook
Level	One of the three classification levels: Public, Internal or Confidential.
Handling rule	What the level requires for one action, such as storing, sharing, printing or disposing of the information.
Label	The visible sign of the level on the information itself: a subject-line tag, a header, a sensitivity label, a stamp or a spoken warning.
Marker	A word added to the level where a law or a duty adds rules of its own: Personal data, Special category or Legal hold. A marker never lowers a level.
Personal data	Information relating to an identified or identifiable living person (GDPR). It is protected under data protection law whatever its level, and the level never decides whether processing it is lawful.
Special category data	Personal data that reveals racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, genetic or biometric data used to identify a person, or data concerning health, sex life or sexual orientation (GDPR Article 9).
Legal hold	An instruction from Legal to keep named information unchanged, whatever its retention period, because of a claim, an investigation or an authority's request.
Aggregation	Combining information so that the whole could cause more harm than any part: every customer's prices in one file, or a rota joined to absence reasons.
Release	The owner's recorded decision that information may be given to anyone. Only release makes information Public.
Mishandling	Handling information against its level's rule: sending it to the wrong person, storing it in the wrong place, losing it, leaving it unattended, or labelling it lower than its level. Report it at once (CL-18).
Information owner	The manager accountable for an information asset: decides its level, who may access it, how long it is kept and when it is released or destroyed.
Custodian	The person or team that holds and runs the information for the owner, usually IT or a supplier: applies the access, storage, backup and disposal controls the level requires.
Sanitise	To make information on a medium impossible to recover, by one of the three methods of NIST Special Publication 800-88 (Guidelines for Media Sanitization): clear, purge or destroy.
CL-nn	The rules of the Information Classification & Handling Policy (CL-01 to CL-20).
P06 clause CL-nn	A contract clause of the Third-Party Security Risk Management pack, which a supplier holding the organisation's information signs. Never one of this pack's rules.
P06 TP-nn, P07 AR-nn, P09 IM-nn, P13 JML-nn, P14 PA-nn	Rules of the third-party, access review, incident, joiner-mover-leaver and privileged access packs, which the Confidential column relies on.
(calc)	A column the workbook calculates. Do not type or paste over it.
EXAMPLE	A worked example: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders, as at 2026-09-30. Delete the EXAMPLE rows on the Handling lookup before approval.

Framework References

Framework references

These references indicate relevance only and do not reproduce the text of any standard.

Framework	Reference	Supported by
ISO/IEC 27001:2022	Annex A 5.12 — Classification of information	Levels and markers: the levels the handling rules are set for
ISO/IEC 27001:2022	Annex A 5.13 — Labelling of information	Labelling by medium: how each medium carries the level
ISO/IEC 27001:2022	Annex A 5.14 — Information transfer	Handling matrix: Share externally and Transfer at each level
NIST CSF 2.0	PR.DS-01 — “The confidentiality, integrity, and availability of data-at-rest are protected”	Handling matrix: Store, Access and Dispose at each level, for data at rest
NIS2 — Directive (EU) 2022/2555	Article 21(2)(i) — “human resources security, access control policies and asset management”	The whole matrix: handling rules for information assets as part of asset management
NIS2 — Implementing Regulation (EU) 2024/2690	Article 1 — lays down the technical and methodological requirements of the Article 21(2) measures, and further specifies when an incident is significant, for DNS service providers, TLD name registries, cloud computing, data centre and content delivery network providers, managed service and managed security service providers, providers of online marketplaces, online search engines and social networking services platforms, and trust service providers	Who the Implementing Regulation binds; for other entities it shows what the regulator expects
NIS2 — Implementing Regulation (EU) 2024/2690	Annex, point 12.2.2 — the policy shall “(a) cover the entire life cycle of the assets, including acquisition, use, storage, transportation and disposal; (b) provide rules on the safe use, safe storage, safe transport, and the irretrievable deletion and destruction of the assets; (c) provide that the transfer shall take place in a secure manner, in accordance with the type of asset to be transferred.”	Handling matrix: storage, use, transfer and disposal across the life cycle
NIS2 — Implementing Regulation (EU) 2024/2690	Annex, point 12.3.2 — the removable media policy shall “(c) provide measures for controlling and protecting portable storage devices containing data while in transit and in storage; (d) where appropriate, provide measures for the use of cryptographic techniques to protect data on removable storage media.”	Handling matrix: Transfer and Store, removable media encrypted and owner-approved for Confidential
NIS2 — Implementing Regulation (EU) 2024/2690	Annex, point 11.7.2 — “The relevant entities shall ensure that the strength of authentication is appropriate for the classification of the asset to be accessed.”	Handling matrix: Access to Confidential through role profiles and privileged access rules
DORA — Regulation (EU) 2022/2554	Article 9(2) — financial entities design, procure and implement ICT security policies, procedures, protocols and tools that aim “to maintain high standards of availability, authenticity, integrity and confidentiality of data, whether at rest, in use or in transit”	Handling matrix: data protected at rest, in use and in transit at every level
DORA — Regulation (EU) 2022/2554	Article 9(4)(d) — “implement policies and protocols for strong authentication mechanisms, based on relevant standards and dedicated control systems, and protection measures of cryptographic keys whereby data is encrypted based on results of approved data classification and ICT risk assessment processes”	Handling matrix: administrator access to systems that hold Confidential information
DORA — Delegated Regulation (EU) 2024/1774	Article 11(2)(a) — the data and system security procedure contains, in accordance with the classification established under Article 8(1) of Regulation (EU) 2022/2554, “the access restrictions referred to in Article 21 of this Regulation, supporting the protection requirements for each level of classification”	Handling matrix: Access, the restrictions set for each level
DORA — Delegated Regulation (EU) 2024/1774	Article 11(2)(e) — “the identification of security measures to ensure that only authorised data storage media, systems, and endpoint devices are used to transfer and store data of the financial entity”	Handling matrix: Store and Transfer, only managed storage, devices and media
DORA — Delegated Regulation (EU) 2024/1774	Article 11(2)(i) — “the identification and implementation of security measures to prevent data loss and leakage for systems and endpoint devices”	Handling matrix: Share externally, AI tools and Transfer, to prevent leakage
DORA — Delegated Regulation (EU) 2024/1774	Article 14(2) — “Financial entities shall design the policies, procedures, protocols, and tools to protect the information in transit referred to in paragraph 1 on the basis of the results of the approved data classification and of the ICT risk assessment.”	Handling matrix: Share externally and Transfer set by the level
GDPR — Regulation (EU) 2016/679	Article 5(1)(f) — personal data shall be “processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’)”	Levels and markers: the Personal data marker at every level
GDPR — Regulation (EU) 2016/679	Article 32(1)(a) — the measures include, as appropriate, “the pseudonymisation and encryption of personal data”	Handling matrix: encryption at rest and in transit for Confidential
GDPR — Regulation (EU) 2016/679	Article 28(3) — a binding contract with the processor, covering documented instructions, confidentiality, security, sub-processors, assistance, return or deletion of data, and audits	Handling matrix: Share externally, processor terms for suppliers that process personal data

Editions referenced: ISO/IEC 27001:2022 incl. Amd 1:2024; NIST CSF 2.0; Directive (EU) 2022/2555 (NIS2) and Implementing Regulation (EU) 2024/2690; Regulation (EU) 2016/679 (GDPR); Regulation (EU) 2022/2554 (DORA) and Delegated Regulation (EU) 2024/1774

ISO/IEC 27001 references name the clause or control this document relates to. They do not say that meeting it meets any other framework's requirement.