Classification Quick-Reference Card & Staff Briefing
One-page staff reference and briefing script explaining the levels with everyday examples.
Available soon
- Format
- Word
- Size
- 59 KB
- Length
- 17 pages
- Version
- 2.0
- Updated
What's inside
What changed
- 2.0
Rewritten to the depth of the other CISO Times packs: a one-page card in staff words, everyday examples drawn from the register, a twenty-minute briefing script with what to say, show and ask, short and team versions, the questions staff ask, scenarios, a follow-up message and a briefing record.
- 1.0
Published.
Preview
The document from section 1, as you will receive it. Highlighted [[text]] is for you to replace; shaded guidance boxes are for you to delete before approval. The cover and document control pages are in the file.
Purpose and audience
Most people will never read the Information Classification & Handling Policy. They need to know three levels, one default, what Confidential means for the things they do every day, and what to do after a mistake. This pack gives them that, and gives whoever briefs them the words to use.
It is used with the Information Classification & Handling Policy, which sets the rules it teaches (CL-nn), and the Classification Level Handling Rules Matrix, which holds the full handling rule for every action. Nothing in it changes a rule.
Part | Audience | Use |
|---|---|---|
Quick-reference card | Everyone who handles our information, including supplier staff | One page to keep in view; given to every new starter |
Everyday examples; before you share | Everyone | The back of the card, or the second page of the intranet version |
Briefing script | Team leaders and the security role, who brief teams | A twenty-minute briefing, a five-minute version and a version for customer service |
Questions staff ask; scenarios | Whoever gives the briefing | Answers to the common questions, and an exercise to check understanding |
Follow-up message; required inputs; briefing record | Head of Information Security | What to send afterwards, what must be ready before, and the record of who was briefed |
Guidance — delete before approval
Brief every team when the policy is first approved, every new starter in their first week, and every team again after a material change to the policy. Teams that send information outside the organisation every day, such as customer service, sales and finance, get the full briefing with their own systems open.
The everyday examples and the opening stories are those of a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders. Replace them with your own before use.
Quick-reference card
One page for everyone who handles our information: staff, contractors and supplier staff. Print it, pin it, put it on the intranet and attach it to the briefing invitation. Replace the placeholders first.
Quick-reference card | Information classification · [[Organisation Name]] · version [[1.0]] |
|---|---|
Three levels | Public: approved for public release. No confidentiality restriction remains. Internal: for the organisation and approved suppliers. Unauthorised disclosure could cause limited harm. Confidential: restricted to named roles or recipients. Unauthorised disclosure, change or loss could cause material harm. |
Not sure? | Treat it as Internal and ask the owner. Unlabelled is Internal, never Public. If it is obviously sensitive, such as customer data in bulk or prices, treat it as Confidential. |
Confidential means | • Keep it in its restricted location. Share a link, not a copy. • Send it outside only to an approved recipient, by an expiring encrypted link. Check the address against a trusted record; never pick it from autocomplete. • Print only when you must, through secure print. Never leave it on a printer or desk; shred every copy. • Never into a personal email, a personal cloud account, a USB stick you were not given for it, or an AI tool not approved for Confidential. • Every copy keeps the label: exports, prints, screenshots and meeting papers. |
Labels | Email: "CONFIDENTIAL" at the start of the subject line, and the Confidential sensitivity label where the system has one. Documents: "Confidential" in the header and footer of every page, and in the document's properties or sensitivity label. Say it before you share it out loud. |
Personal data | Data protection law applies whatever the label. Health information, and customer or staff data in bulk, are always Confidential. |
AI tools | Public: any tool. Internal: only [[approved tools for Internal]]. Confidential: only [[approved tools for Confidential, or none]]. Health information: never. |
Throwing away | Confidential paper: the confidential waste console or a cross-cut shredder. Laptops, phones, disks and USB sticks: back to IT, never binned, sold or given away. |
Made a mistake? | Report it at once: [[incident reporting route]]. Nobody is blamed for a report made in good faith. Do not forward or delete anything. |
Ask | [[Information owner, or the security contact and how to reach them]] |
Everyday examples
EXAMPLE situations, with the level the owner gave each in the register. Replace them with ten or so from your own organisation, at least two at each level.
Situation | Level | What to do |
|---|---|---|
A customer asks for the product catalogue | Public | Send the link to the website. Anyone may have it. |
A new contact centre agent asks for the customer service scripts | Internal | Point them to the knowledge base. Ask the owner before sending the scripts to anyone outside. |
A supplier asks for a copy of a security procedure | Internal | Approved suppliers with a business need may have it; check the address before sending. |
The warehouse shift rota for next week | Internal Personal data | Share it with the team that works the shifts, inside the scheduling system. Do not post it anywhere outside. |
Next quarter's sales forecast | Internal | Share it with colleagues who need it, by a link to the sales site. |
The network diagram the IT provider asks for | Internal | Share it through the IT documentation site the provider already uses. |
Freight quotes on the new rate comparison site | Internal | Treat as Internal until the owner decides. |
A spreadsheet of every customer's prices and discounts | Confidential | Keep it in the restricted sales folder. One customer's own price list may go to that customer; the whole file never leaves the folder. |
An export of customer orders with delivery addresses | Confidential Personal data | Save it only in the Confidential export folder. To send it to a customer, use an expiring encrypted link, to an address checked against the account record. |
A payroll report | Confidential Personal data | Payroll team only. Never print it at home or send it to a personal account. |
A doctor's note from a member of your team | Confidential Personal data, Special category | Pass it to HR and do not keep a copy. Health information is for named people only. |
An email asking to change a supplier's bank details | Confidential | Do not change anything from an email. Pass it to finance for their check, and report it if it looks wrong. |
Board papers left on a meeting room table | Confidential | Take them to their owner or the confidential waste console, and tell the owner. |
Before you share
- What level is it? Look for the label. No label: treat it as Internal.
- Does every recipient need it? Remove anyone who does not.
- Is the address right? For Confidential, check it against a trusted record, not autocomplete.
- Can I send a link instead of a copy?
- Am I using the approved channel for its level?
- Does it contain anything more sensitive than the main file, such as a hidden tab or a column of personal data?
Markers
Marker | What it means for you |
|---|---|
Personal data | Data protection law applies, whatever the level. Use it only for the purpose it was collected for, and keep it no longer than needed. |
Special category | Health and other sensitive personal information. Named people only; never printed outside the office, put on a USB stick or into an AI tool. |
Legal hold | Legal has told you to keep it. Do not change, delete or throw it away until Legal releases it in writing. |
Briefing script
A twenty-minute briefing for any team, given by a team leader or the Head of Information Security. Each part says what to say, what to show and one question to ask, so you can tell it has landed. The words are a guide: say them your own way, but keep the rules exact.
Running order
Part | Minutes | Card row it teaches | Ask |
|---|---|---|---|
1. Why this matters | 3 | Made a mistake? | Which of the two stories could have happened in your team? |
2. Three levels and the default | 4 | Three levels; Not sure? | A file has no label. What level is it? |
3. Labels | 3 | Confidential means | How do you mark an email Confidential? |
4. Sharing outside the organisation | 4 | Confidential means; Before you share | Where do you get a customer's email address from before sending Confidential information? |
5. AI tools, printing and working away from the office | 3 | Confidential means | Which AI tools may you use for Internal information? |
6. Throwing things away | 1 | Throwing away | Where does an old phone go? |
7. Mistakes: report at once | 2 | Made a mistake? | You have just sent a file to the wrong customer. What do you do first? |
1. Why this matters (3 minutes)
Say: In one month at a distributor much like us, two things happened. A customer service agent emailed a spreadsheet of 212 customers' names, delivery addresses and order histories to the wrong business customer, picking the address from autocomplete. It had to be notified to the supervisory authority as a personal data breach. And a check found a spreadsheet of every customer's prices on a team site that all 900 staff could open. Neither person meant any harm. Both files were missing the one thing that would have told them to take care: the right label.
Show: The card's last two rows.
Ask: Which of the two stories could have happened in your team?
2. Three levels and the default (4 minutes)
Say: We have three levels. Public: approved for public release. No confidentiality restriction remains. Internal: for the organisation and approved suppliers. Unauthorised disclosure could cause limited harm. Confidential: restricted to named roles or recipients. Unauthorised disclosure, change or loss could cause material harm. Almost everything you work with is Internal. If something has no label, it is Internal. Only its owner can make something Public. Confidential is for information whose loss, change or disclosure could do real harm: customer data in bulk, prices, payroll, health information, supplier bank details, board papers. It is not for everything that feels important.
Show: The card's first two rows; the everyday examples.
Ask: A file has no label. What level is it?
3. Labels (3 minutes)
Say: The label is how the next person knows. Confidential email: "CONFIDENTIAL" at the start of the subject line, and the Confidential sensitivity label where the system has one. Confidential documents: "Confidential" in the header and footer of every page, and in the document's properties or sensitivity label. Every export, print and copy carries it. In a meeting, the chair says so at the start. On the phone, say it before you share it.
Show: A labelled email and document from your own systems.
Ask: How do you mark an email Confidential?
4. Sharing outside the organisation (4 minutes)
Say: Internal information may go to approved suppliers and partners who need it, under their contract. Check the address. Confidential information goes outside only to a recipient its owner has approved, by an expiring encrypted link or an encrypted file, with the address checked against a trusted record, such as the customer's account. Never type it from memory or pick it from autocomplete. That is the rule that would have stopped the spreadsheet going to the wrong customer.
Show: How to send an encrypted, expiring link in your own email or file system; the before-you-share checklist.
Ask: Where do you get a customer's email address from before sending Confidential information?
5. AI tools, printing and working away from the office (3 minutes)
Say: For Internal information: only AI tools the organisation has approved for Internal [[list]], signed in with the work account, under a contract that bars using its data to train models. For Confidential information: only AI tools the organisation has approved for Confidential [[list, which may be none]], under a contract assessed under the third-party pack that bars using its data to train models. Never a personal or free tool. Special category data never. Printing Confidential: only when necessary, through secure print release, labelled on every page. Never left on a printer or desk; every copy shredded when no longer needed. Working away from the office: only on managed, encrypted devices. Not printed at home, not worked on where it can be overlooked or overheard, and not discussed on speaker in shared spaces.
Show: The list of approved AI tools, by level.
Ask: Which AI tools may you use for Internal information?
6. Throwing things away (1 minute)
Say: Confidential paper goes in the confidential waste console or the cross-cut shredder. Laptops, phones, disks and USB sticks go back to IT, whatever level they held: IT wipes or destroys them and gets a certificate for every item.
Show: Where the confidential waste consoles are; how to return a device to IT.
Ask: Where does an old phone go?
7. Mistakes: report at once (2 minutes)
Say: Report a mistake at once, through the incident reporting route (P09 IM-01). Nobody is blamed for a report made in good faith. The quicker it is reported, the more can be done. The agent who sent the spreadsheet reported it straight away, and the recipient deleted it the same day.
Show: The reporting route, on the card.
Ask: You have just sent a file to the wrong customer. What do you do first?
Guidance — delete before approval
The opening stories are the EXAMPLE's: INC-2026-016 and the price export found in the handling check on 17 Sep 2026. Replace them with your own where you have them. A story from your own organisation, told without names, persuades better than any rule.
Hand out the card at the start and keep it in view: each part teaches one row of it.
Five-minute version for team meetings
- Three levels: Public, Internal, Confidential. No label means Internal.
- Confidential is customer data in bulk, prices, payroll, health information, supplier bank details and board papers. Label it, keep it in its place, share a link.
- Outside the organisation: check the address against a trusted record. Never autocomplete for Confidential.
- No Confidential information in unapproved AI tools, personal email or personal cloud storage.
- Made a mistake? Report it at once. Nobody is blamed for reporting.
For customer service agents
Customer service agents send more information to outside recipients than any other team, and they are the ones who meet the customer accounts and order history every day. Give them the full briefing, and spend the extra time on part 4 with their own email and file system open: send a test order history to a colleague by an encrypted, expiring link, and look up an address on the account record.
Guidance — delete before approval
EXAMPLE: action HA-02 after INC-2026-016: brief every customer service agent on sharing Confidential information outside the organisation, with the quick-reference card, owned by the Head of Information Security, due 16 Oct 2026. The distributor has 60 people in the customer service agent profile, so the briefing runs as [[four]] sessions of [[15]] people. (EXAMPLE)
Questions staff ask
Question | Answer | Rule |
|---|---|---|
Who decides the level? | The information owner: the manager accountable for that information. If you create something new, it is Internal until its owner decides. | CL-03, CL-04 |
Should I mark everything Confidential to be safe? | No. Confidential is for information whose loss, change or disclosure could cause material harm. If everything is Confidential, nobody can tell what really needs care. | CL-02 |
The file has no label. Can I send it to a supplier? | Treat it as Internal: an approved supplier with a business need may have it, under its contract. If it looks more sensitive, such as customer data or prices, ask the owner first. | CL-04, CL-05 |
It is on our website already. Is it Public? | Only the version the owner released. Working drafts and the data behind it keep their own level. | CL-05 |
Is personal data always Confidential? | No. A rota with names is Internal with the Personal data marker. Health information, and personal or customer data at scale, are always Confidential. Data protection law applies whatever the level. | CL-07, CL-14 |
Can I use an AI tool to summarise a document? | Public information: any tool. Internal and Confidential: only the tools approved for that level, signed in with your work account. Health and other special category data: never. | CL-19 |
Can I work on Confidential information at home? | On a managed, encrypted device, where nobody can see or hear it. Do not print it at home. | CL-06 |
A customer asks me to email their own order history. Is that allowed? | Yes, to that customer, by the approved channel for Confidential information, to the address on their account record. | CL-08 |
I sent something to the wrong person. Will I be in trouble? | Nobody is blamed for reporting a mistake in good faith. Hiding it is what causes harm. Report it at once. | CL-18 |
The level looks wrong. What do I do? | Tell the owner. The owner reviews it; until then, handle it at the higher of the two levels you think it might be. | CL-10 |
Scenarios to check understanding
Read each one out and ask for the level and what to do. The answers follow the table.
Situation | |
|---|---|
1 | You find a spreadsheet called "all customer prices Sept" on a team site everyone can open. It is labelled Internal. |
2 | A colleague asks you to email them the product catalogue PDF from the website. |
3 | You have written a new procedure for your team and not shown it to anyone yet. |
4 | A team leader asks you to paste staff sickness records into a free online AI tool to find patterns. |
5 | Autocomplete offers two customers with similar names when you send an order history export. |
6 | A supplier emails new bank details and asks you to update them before tomorrow's payment run. |
7 | Your old work laptop is being replaced. A colleague offers to wipe it and sell it. |
8 | You need next week's warehouse rota at home to plan cover. |
Answers
Level | Why, and what to do | |
|---|---|---|
1 | Confidential | Every customer's prices in one file is Confidential, whatever the label says (CL-13). Do not open it further; tell the owner and report it (CL-18). |
2 | Public | Released by its owner (CL-05). |
3 | Internal | New business information starts at Internal until its owner decides (CL-04). |
4 | Confidential | Health information is special category data: always Confidential, and never put into an AI tool (CL-14, CL-19). |
5 | Confidential | Stop: check the address against the account record, and send by an expiring encrypted link (CL-08). |
6 | Confidential | Supplier bank details are Confidential on integrity: a changed detail diverts a payment. Do not act on the email; pass it to finance and report it if it looks wrong. |
7 | Confidential | A device takes the level of the most sensitive information it held (CL-01). It goes back to IT for disposal with a certificate (CL-11). |
8 | Internal | Internal with the Personal data marker: on a managed device or app, not printed and left lying around (CL-06, CL-07). |
Guidance — delete before approval
Use scenarios from your own teams once you have them. The best ones come from questions people asked in earlier briefings and from the quarterly handling checks.
What to do after a mistake
For the card's last row, in more detail. Report at once, through the incident reporting route (P09 IM-01). Nobody is blamed for a report made in good faith.
- Stop it going further: do not forward it, and recall or unshare it if the system lets you.
- Do not delete anything, and do not contact the recipient unless the incident manager asks you to.
- Report it at once through the incident reporting route, saying what was sent or exposed, to whom, when, and its level.
- Write down what you remember while it is fresh: the time, the address, the file name.
What happens next is the incident team's job, under the Incident Triage & First-Hour Assessment Procedure. Where personal data is involved, the Data Protection Officer is involved too, and the incident pack decides whether anyone outside must be told.
Follow-up message
Sent by the person who gave the briefing, the same day, with the card attached.
Field | Template |
|---|---|
To | [[team or distribution list]] |
From | [[Head of Information Security]] |
Subject | Information classification: your card and the three things to remember |
Message | Thank you for coming to the briefing on [[date of the briefing]]. The quick-reference card is attached and on the intranet at [[location]]. The three things to remember: 1. No label means Internal. Confidential is always labelled, on every copy. 2. Confidential information goes outside only to an approved recipient, by an expiring encrypted link, to an address checked against the account record. Keep [[team]] exports in [[the restricted location for your team's Confidential files]]. 3. Made a mistake? Report it at once: [[incident reporting route]]. Nobody is blamed for reporting. Questions to [[security contact]]. |
Field | EXAMPLE, 16 Oct 2026 |
|---|---|
To | All customer service agents (60) |
From | Head of Information Security |
Subject | Information classification: your card and the three things to remember |
Message | Thank you for coming to the briefing on 16 Oct 2026. The quick-reference card is attached and on the intranet at [[location]]. The three things to remember: 1. No label means Internal. Confidential is always labelled, on every copy. 2. Confidential information goes outside only to an approved recipient, by an expiring encrypted link, to an address checked against the account record. Keep customer service exports in the Confidential export folder. 3. Made a mistake? Report it at once: [[incident reporting route]]. Nobody is blamed for reporting. Questions to [[security contact]]. |
Required inputs with owners
What must be ready before the first briefing.
Input | Needed for | Owner |
|---|---|---|
The approved Information Classification & Handling Policy | Every part | Head of Information Security |
The card filled in: reporting route, security contact, approved AI tools for Internal and Confidential | Card; parts 5 and 7 | Head of Information Security |
Email and document labels set up, and the external-recipient warning on | Part 3; part 4 | Custodian |
The restricted locations for each team's Confidential files and exports | Part 4; the follow-up message | Custodian |
Everyday examples and stories from your own organisation | Card; part 1 | Information owners, with the security role |
Where the confidential waste consoles are; how to return a device | Part 6 | Records manager; Custodian |
The list of teams, people and dates to brief | Briefing record | Head of Information Security |
Briefing record
One line per briefing, kept by the Head of Information Security in [[the organisation's records system]]. Questions you could not answer go to the policy owner; questions that show a rule is unclear go into the next review of the policy.
Date | Team | Given by | People briefed | Questions raised | Follow-up |
|---|---|---|---|---|---|
[[YYYY-MM-DD]] | [[team]] | [[name]] | [[number]] of [[number]] | [[questions, and who answers them]] | [[follow-up sent; actions]] |
Planned: 16 Oct 2026 EXAMPLE | Customer service agents | Head of Information Security | [[n]] of 60 | Action HA-02 |
Guidance — delete before approval
This record shows the policy was communicated to everyone who handles information, which is what an auditor asks for.
Related documents
Document | Relationship |
|---|---|
Information Classification & Handling Policy | The levels, markers and rules (CL-01 to CL-20) the card and the briefing teach |
Classification Level Handling Rules Matrix | The full handling rule for every action at every level |
Classification & Labelling Procedure | How owners classify and label, and the first steps after mishandling |
Information Asset Register | The register the everyday examples come from |
Secure Information Disposal Checklist | How devices and media are disposed of, for part 6 |
Incident Triage & First-Hour Assessment Procedure | What happens after a mistake is reported |
Adapting this template
Guidance — delete before approval
Small organisation: give the briefing to everyone at once, in fifteen minutes, and send the card by email. Keep the stories and the scenarios: they do more than the rules.
Regulated entity: NIS2's Implementing Regulation (EU) 2024/2690 asks for the handling policy to be communicated to everyone who uses or handles assets (Annex, point 12.2.1). The briefing record is the evidence; keep it for every team and every new starter.
Supplier staff: give the card to supplier staff who handle Internal or Confidential information, through the supplier's own manager, and ask the supplier to confirm they have it. Supplier staff in your offices or systems are briefed like your own.
Delete this section before approval.
Framework references
These references show where this document supports an external framework. They indicate relevance only and do not reproduce the text of any standard. ISO/IEC 27001 references name the clause or control this document relates to. They do not say that meeting it meets any other framework's requirement. Editions referenced: ISO/IEC 27001:2022 incl. Amd 1:2024; NIST CSF 2.0; Directive (EU) 2022/2555 (NIS2) and Implementing Regulation (EU) 2024/2690; Regulation (EU) 2016/679 (GDPR); Regulation (EU) 2022/2554 (DORA) and Delegated Regulation (EU) 2024/1774.
Framework | Reference | Supported by |
|---|---|---|
ISO/IEC 27001:2022 | Annex A 6.3 — Information security awareness, education and training | The briefing script, the five-minute and customer service versions, the scenarios and the briefing record |
ISO/IEC 27001:2022 | Annex A 5.10 — Acceptable use of information and other associated assets | The card's rows on Confidential, AI tools and throwing away |
ISO/IEC 27001:2022 | Annex A 5.13 — Labelling of information | The card's row on labels; part 3 of the briefing |
ISO/IEC 27001:2022 | Annex A 6.7 — Remote working | Part 5: working away from the office |
ISO/IEC 27001:2022 | Annex A 6.8 — Information security event reporting | What to do after a mistake; part 7 of the briefing |
NIST CSF 2.0 | PR.AT-01 — “Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind” | The card and the briefing: staff given the knowledge to handle information by its level |
NIS2 — Directive (EU) 2022/2555 | Article 21(2)(i) — “human resources security, access control policies and asset management” | The whole pack |
NIS2 — Implementing Regulation (EU) 2024/2690 | Article 1 — lays down the technical and methodological requirements of the Article 21(2) measures, and further specifies when an incident is significant, for DNS service providers, TLD name registries, cloud computing, data centre and content delivery network providers, managed service and managed security service providers, providers of online marketplaces, online search engines and social networking services platforms, and trust service providers | Regulated-entity tailoring: the entities the Implementing Regulation binds |
NIS2 — Implementing Regulation (EU) 2024/2690 | Annex, point 12.2.1 — “The relevant entities shall establish, implement and apply a policy for the proper handling of assets, including information, in accordance with their network and information security policy, and shall communicate the policy on proper handling of assets to anyone who uses or handles assets.” | The handling rules communicated to everyone who handles information; the briefing record |
GDPR — Regulation (EU) 2016/679 | Article 5(1)(f) — personal data shall be “processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’)” | The Personal data marker as staff see it; part 2 of the briefing |
GDPR — Regulation (EU) 2016/679 | Article 32(4) — “The controller and processor shall take steps to ensure that any natural person acting under the authority of the controller or the processor who has access to personal data does not process them except on instructions from the controller, unless he or she is required to do so by Union or Member State law.” | Staff and supplier staff act on the owner's instructions for personal data |
Definitions
Term | Meaning in this pack |
|---|---|
Classification | The owner's decision on how much protection an information asset needs, made from the harm that unauthorised disclosure, unauthorised change or loss of availability could cause. |
Level | One of the three classification levels: Public, Internal or Confidential. |
Label | The visible sign of the level on the information itself: a subject-line tag, a header, a sensitivity label, a stamp or a spoken warning. |
Marker | A word added to the level where a law or a duty adds rules of its own: Personal data, Special category or Legal hold. A marker never lowers a level. |
Information owner | The manager accountable for an information asset: decides its level, who may access it, how long it is kept and when it is released or destroyed. |
Personal data | Information relating to an identified or identifiable living person (GDPR). It is protected under data protection law whatever its level, and the level never decides whether processing it is lawful. |
Special category data | Personal data that reveals racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, genetic or biometric data used to identify a person, or data concerning health, sex life or sexual orientation (GDPR Article 9). |
Unlabelled information | Treat unlabelled business information as Internal (CL-04). Never treat it as Public (CL-05). If it is obviously more sensitive, such as personal data at scale or prices, treat it as Confidential, ask the owner, and report it if it was in the wrong place (CL-18). |
Mishandling | Handling information against its level's rule: sending it to the wrong person, storing it in the wrong place, losing it, leaving it unattended, or labelling it lower than its level. |
CL-nn | Rule numbers in the Information Classification & Handling Policy. |