Information Asset Classification Workbook

What's inside

What changed

Preview

Instructions

Impact criteria

Impact by area

Classification assessment

Reclassification

Summary

Lists

Definitions

Framework References

Guides owners through classifying a data set by confidentiality, integrity and availability impact.

Available soon

Format: Excel
Size: 75 KB
Length: 12 sheets
Version: 2.0
Updated: 1 Oct 2026

Follow this documentFree account. We can email you when it changes.

Instructions
Impact criteria
Impact by area
Classification assessment
Reclassification
Summary
Lists
Definitions
Framework References

2.01 Oct 2026
Rewritten to the depth of the other CISO Times packs: impact criteria for 5 areas on the risk scale's four impact levels, the three questions with examples, and the decision steps and special cases; an impact-by-area worksheet that rates an asset on its own and combined (CL-13); the assessment of every asset with ratings, markers, the level they give and the owner's decision; the reclassification record and its triggers; a summary; and the distributor's 17 assets and re-rated price export as the worked example.
1.01 Oct 2026
Published.

Changes across this pack

The workbook's sheets as you will receive them, with its example rows and the values its formulas calculate. Highlighted [[text]] is for you to replace; rows marked EXAMPLE are for you to delete. Wide sheets scroll sideways. The cover, document control and changelog sheets are in the file.

How to use this workbook

Step	What to do
1	Read the Impact criteria first: the 5 areas at each impact level, the three questions with examples, and the decision steps. The levels are the risk scale's: 1 Minor, 2 Moderate, 3 Major, 4 Severe. A rating is read from them: Low is Minor; Medium is Moderate; High is Major or Severe.
2	For an asset that needs care, use the Impact by area sheet: rate confidentiality, integrity and availability against every area, 1 to 4, taking each area's worst case. Rate the information as it is, before the controls that protect it (step 2). If the asset is combined, exported or reported in bulk, rate the combination too: the worksheet takes the higher (CL-13).
3	Enter the three levels on the Classification assessment sheet, one row per asset, with the asset ID the Information Asset Register gives it. The ratings and the level calculate: any High gives Confidential; a highest of Medium gives Internal; all Low gives Public only once the owner approves release, otherwise Internal (CL-02, CL-05).
4	Mark the markers that apply (CL-07, CL-14, CL-15), then the owner enters the level they approve, the reason (the harm, not the value) and the date (CL-03). The owner may choose a higher level and records why; never a lower one. Until the owner decides, the asset is handled as Internal (CL-04).
5	Copy each decision to the Information Asset Register. When a trigger on the Reclassification sheet occurs, assess the asset again and record the change, its reason and its actions there.
6	Clear every Check that does not say OK. Delete the EXAMPLE rows and the EXAMPLE working before approval. Do not type over the white calculated cells.

Legend

Yellow cells are inputs. Everything else is calculated or fixed — do not overwrite formulas.

EXAMPLE

Rows marked EXAMPLE in the first column show how a completed row looks. Delete them before approval.

EXAMPLE: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders. Its 17 assets give 2 Public, 7 Internal and 7 Confidential, with one awaiting its owner: not everything is Confidential. The customer price lists were first rated Internal on 19 Aug 2026, one customer's list at a time; the handling check on 17 Sep 2026 found the export of every customer's prices open to all staff, and the Sales Director re-rated the combination Confidential (CL-13). The Impact by area sheet shows that working.

Tailoring for a small organisation: use the Classification assessment alone for most assets; keep the Impact by area worksheet for customer, financial and staff data, and for any export or report that combines records.

Tailoring for a regulated entity: NIS2's Implementing Regulation (EU) 2024/2690 asks for levels based on confidentiality, integrity, authenticity and availability (Annex 12.1.2). Treat authenticity with integrity, or add a column for it. A DORA financial entity aligns availability with its continuity and recovery objectives.

Tailoring where a service provider runs your IT: the provider can tell you where information is held and how it is copied, but the owner rates the harm and decides the level. Ask the provider for the exports and reports its systems produce, so the combination can be rated.

Impact criteria, questions and the decision

Judge each of confidentiality, integrity and availability against every area and take the worst (CL-02). The areas are the risk scale's, so a classification and a risk judge the same harm the same way.

The impact criteria, by area and impact level

Area	1 Minor (Low)	2 Moderate (Medium)	3 Major (High)	4 Severe (High)
Financial	less than [[€50,000]]	[[€50,000]] to [[€250,000]]	[[€250,000]] to [[€1,000,000]] For example: Supplier bank details changed before a payment run	more than [[€1,000,000]]
Service	an internal service degraded for hours	a customer service degraded, or an internal service stopped, for up to [[1]] day For example: Dispatch plans unavailable for a few hours, restored from backup	a core customer service stopped for up to [[2]] days For example: Orders, prices or payments wrong in bulk	a core customer service stopped for more than [[2]] days
Data	internal, non-personal data For example: Business contact details already public, or no one identifiable	internal confidential data, or personal data of a few people	personal or customer data of [[hundreds]] of people, or commercially sensitive data For example: Any one person exposed to fraud, distress or discrimination	personal or customer data at scale For example: Special category data of any number of people (CL-14)
Legal and regulatory	no notification or breach	a minor breach of contract or policy, put right without penalty	a formal enquiry by a regulator or customer, or a contract breach with penalties For example: A breach a customer must be told of under contract	a notifiable breach, enforcement or contract termination
Reputation	not noticed outside the team	noticed by some customers or suppliers For example: One customer sees another's prices, put right privately	complaints from several major customers, or regional or trade press	national press, or loss of a major customer

The areas and the words at each level are the risk scale's own (Risk Assessment Methodology & Scoring Model); the examples beneath are this pack's. Money thresholds are the risk scale's [[placeholders]].

The three questions, with examples at each rating

Property	Question	Low (1)	Medium (2)	High (3 or 4)
Confidentiality	What harm if the wrong person saw it?	A product specification sheet a supplier publishes anyway; A meeting room booking list	Next quarter's marketing plan; A warehouse shift rota with staff names; Network diagrams with no passwords in them	Every customer's prices and discounts in one file; Payroll and staff bank details; Customer order history with delivery addresses; Sickness absence records
Integrity	What harm if it were changed without authority, or wrong?	A draft agenda; An internal newsletter	Stock levels corrected at the next count; A policy page someone edited by mistake	A supplier's bank details changed before a payment run; Customer prices changed in bulk and invoiced; Payroll amounts
Availability	What harm if it could not be used when needed?	An archive of last year's marketing material; Training slides	Dispatch plans unavailable for a few hours, restored from backup; Shift rotas for one site for a day	Online orders and customer sign-in for more than a day; Payroll data in the week of a pay run

The decision, step by step

Step	What to do	Rule
1	Name the information asset, its purpose, its owner, where it is held and every regular copy or export.	CL-01
2	Rate confidentiality, integrity and availability on the impact criteria, each against every area, taking the worst. Rate the information as it is, before the controls that protect it.	CL-02
3	Check aggregation: does the asset, or an export of it, combine information so that the whole could do more harm than any part? If so, rate the whole.	CL-13
4	Take the level the ratings give: any High is Confidential; a highest of Medium is Internal; all Low is Public only once the owner approves release, otherwise Internal.	CL-02
5	Add the markers that apply: Personal data, Special category (which needs Confidential) and Legal hold.	CL-07
6	The owner approves the level and records the reason in the register. While the decision is incomplete, the asset is Internal.	CL-03
7	Apply the label for each medium and the handling rule for each action, to the source and to every copy.	CL-06
8	Set the review date: 12 months, or sooner on a trigger.	CL-12

Special cases

Case	What decides it	Rule
Highest justified level	The level is the highest that any one of confidentiality, integrity or availability justifies, and no higher. An owner who chooses a higher level records why. Value is not harm: information is not Confidential because it is important.	CL-02
Aggregation	A collection, export or report takes the highest level of anything in it. Where combining items raises the harm, the owner rates the combination: one customer's price list goes to that customer, but every customer's prices in one file is Confidential.	CL-13
Personal data	Personal data carries the Personal data marker at every level, and data protection law applies whatever the label. A shift rota with names is Internal with the marker; the label does not decide whether processing is lawful.	CL-07
Special category data	Special category data, and personal or customer data at scale, are always Confidential. The risk scale rates personal or customer data at scale Severe in its Data area, and this pack rates special category data the same for any number of people.	CL-14
Legal hold	A legal hold adds the Legal hold marker and stops deletion and disposal until Legal releases it in writing. It does not change the level.	CL-15
Copies and exports	A copy, export, print or extract keeps the level of its source, carries its label, and is deleted when it is no longer needed.	CL-09
Systems and media	A system, device or medium takes the highest level of the information it holds, and is protected and disposed of at that level.	CL-01

Impact by area: one asset, on its own and combined

Rate each property against every area, 1 to 4 on the risk scale (step 2). If the asset is combined, exported or reported in bulk, rate the combination in the right-hand columns: each property is rated at the higher of the two (CL-13).

Asset ID and name	EXAMPLE: IA-02 Customer price lists and discount terms
On its own	One customer's price list, sent to that customer
Combined, exported or reported as	The monthly export of every customer's prices and discounts
Assessed on, by	17 Sep 2026, Sales Director with the Head of Information Security

Area	Confidentiality: on its own	Integrity: on its own	Availability: on its own	Confidentiality: combined	Integrity: combined	Availability: combined	Why (the worst case in this area)
Financial	2	2	1	3	3	1	One list lets a competitor undercut one customer; every list lets it undercut every bid, and a bulk price error is invoiced to every customer.
Service	1	2	2	1	3	2	A wrong price list slows quoting for a day; prices wrong in bulk mean orders invoiced wrongly in bulk.
Data	2	1	1	3	1	1	Business customers' prices: no individual is identifiable. One customer's list is internal confidential data; every customer's prices in one file is commercially sensitive data.
Legal and regulatory	2	1	1	2	1	1	Customer contracts keep agreed prices confidential: a minor breach of contract, put right without penalty.
Reputation	2	2	1	3	2	1	One customer seeing another's price is put right privately; every customer's prices leaking brings formal complaints.
Worst level (calc)	2	2	2	3	3	2	The worst area sets each property's level (CL-02).
Rating (calc)	Medium	Medium	Medium	High	High	Medium
Set by (calc)	Financial	Financial	Service	Financial	Financial	Service	The first area at the worst level.

Result

Does combining raise the harm? (calc)	Yes: rate the whole (CL-13)
Each property as rated (calc)	3	3	2	Confidentiality, integrity and availability: the higher of on its own and combined.
Level on its own (calc)	Internal
Release approved by the owner	No
Level the ratings give (calc)	Confidential			Copy the three levels in "Each property as rated" to the Classification assessment sheet.

One row per information asset. Enter the three impact levels (1 to 4); the ratings and the level calculate (CL-02). The owner's decision is recorded beside them (CL-03). Yellow columns are inputs.

Example	Asset ID	Information asset	Owner	Confidentiality (impact level 1–4)	Integrity (impact level 1–4)	Availability (impact level 1–4)	Confidentiality rating (calc)	Integrity rating (calc)	Availability rating (calc)	Highest rating (calc)	Aggregation: what combining adds (CL-13)	Release approved	Level the ratings give (calc)	Personal data?	Special category?	Legal hold?	Owner's decision	Reason: the harm that sets the level	Decided on	Check (calc)
EXAMPLE	IA-01	Customer accounts and order history	Chief Operating Officer	4	3	3	High	High	High	High		No	Confidential	Yes	No	No	Confidential	Names, delivery addresses and order histories of every customer: personal and customer data at scale.	21 Aug 2026	OK
EXAMPLE	IA-02	Customer price lists and discount terms	Sales Director	3	3	2	High	High	Medium	High	The monthly export of every customer's prices and discounts: rated as a whole (Impact by area)	No	Confidential	No	No	No	Confidential	Every customer's prices and discounts together would let a competitor undercut bids and customers reopen terms; a price changed in bulk is invoiced wrongly.	17 Sep 2026	OK
EXAMPLE	IA-03	Online orders and customer sign-in accounts	Chief Operating Officer	4	3	4	High	High	High	High		No	Confidential	Yes	No	No	Confidential	Takes 60% of orders; customer accounts at scale; an outage of more than 2 days is the risk register's R-01.	21 Aug 2026	OK
EXAMPLE	IA-04	Payroll and staff bank details	Chief Financial Officer	4	4	3	High	High	High	High		No	Confidential	Yes	No	No	Confidential	Pay and bank details of every member of staff; a wrong payment run hits the whole workforce.	24 Aug 2026	OK
EXAMPLE	IA-05	Staff HR records, including sickness absence	HR Director	4	2	2	High	Medium	Medium	High		No	Confidential	Yes	Yes	No	Confidential	Health information about named staff: special category data (CL-14).	24 Aug 2026	OK
EXAMPLE	IA-06	Supplier master data and bank details	Chief Financial Officer	2	3	2	Medium	High	Medium	High		No	Confidential	No	No	No	Confidential	A changed bank detail diverts a payment run: the risk register's R-02, and the attempt in the incident pack's INC-2026-015. Integrity sets the level.	24 Aug 2026	OK
EXAMPLE	IA-07	Board and executive committee papers	Chief Executive	3	2	1	High	Medium	Low	High		No	Confidential	No	No	No	Confidential	Investment decisions and results before they are announced.	25 Aug 2026	OK
EXAMPLE	IA-08	Warehouse stock levels and dispatch plans	Head of Logistics	1	2	2	Low	Medium	Medium	Medium		No	Internal	No	No	No	Internal	An outage of hours slows dispatch and is restored from backup; nothing in it harms anyone if seen.	26 Aug 2026	OK
EXAMPLE	IA-09	Warehouse shift rotas	Head of Logistics	2	1	2	Medium	Low	Medium	Medium		No	Internal	Yes	No	No	Internal	Staff names and shifts: personal data with limited harm. Internal with the Personal data marker (CL-07).	26 Aug 2026	OK
EXAMPLE	IA-10	Policies, standards and procedures	Head of Information Security	1	2	1	Low	Medium	Low	Medium		No	Internal	No	No	No	Internal	Not harmful if seen; an unauthorised edit could mislead staff until noticed.	27 Aug 2026	OK
EXAMPLE	IA-11	Sales forecasts and marketing plans	Sales Director	2	1	1	Medium	Low	Low	Medium		No	Internal	No	No	No	Internal	Useful to a competitor for a season; limited harm.	19 Aug 2026	OK
EXAMPLE	IA-12	IT network diagrams and system documentation	Head of IT	2	2	2	Medium	Medium	Medium	Medium		No	Internal	No	No	No	Internal	Helps an attacker plan, but holds no credentials: those are in the vault (P14 PA-10).	27 Aug 2026	OK
EXAMPLE	IA-13	Supplier product data: specifications, barcodes and pack sizes	Procurement Manager	1	2	1	Low	Medium	Low	Medium		No	Internal	No	No	No	Internal	Published by suppliers anyway; wrong data causes picking errors until corrected.	20 Aug 2026	OK
EXAMPLE	IA-14	Customer service scripts and answers to common questions	Chief Operating Officer	1	1	1	Low	Low	Low	Low		No	Internal	No	No	No	Internal	Every impact Low, but never released: Internal (CL-04, CL-05).	21 Aug 2026	OK
EXAMPLE	IA-15	Published product catalogue and website pages	Head of Marketing and Communications	1	1	1	Low	Low	Low	Low		Yes	Public	No	No	No	Public	Release approved by the owner; prices are shown only after sign-in, from IA-02.	21 Aug 2026	OK
EXAMPLE	IA-16	Press releases and the published annual report	Head of Marketing and Communications	1	1	1	Low	Low	Low	Low		Yes	Public	No	No	No	Public	Released on publication; drafts before release are Confidential board papers (IA-07).	25 Aug 2026	OK
EXAMPLE	IA-17	Freight rates and quotes on the rate comparison site	Head of Logistics									No	Internal	No	No	No		Awaiting the owner's decision: handled as Internal meanwhile (CL-04).		Rate all three: handled as Internal (CL-04)

Reclassification: the record, its actions and the triggers

Reclassify when a change in purpose, content, audience, incident or contract changes the impact (CL-10). Only the owner lowers a level, with the reason and date recorded. Confidential becomes Public only through a release decision (CL-05). A lower level applies to the new version and its future copies; copies already shared keep the label they carry until replaced.

The record (EXAMPLE: IA-02)

	Confidentiality	Integrity	Availability	Level (calc)
Impact levels before	2	2	2	Internal
Impact levels after	3	3	2	Confidential

Actions

Action	Owner	Due	Done	Status (calc)
Move the export to a Confidential location open only to the sales account manager profile	Head of IT	18 Sep 2026	18 Sep 2026	Done on time
Check the site's access log for opening of the export by anyone outside that profile since it was first saved there	Head of Information Security	24 Sep 2026	23 Sep 2026	Done on time	Result: Opened by 3 people outside sales, all in finance, for invoicing queries; no sign it left the organisation, so no incident was declared.
Label the ERP's price list report Confidential at the source, so every export carries it (CL-09)	Head of IT	31 Oct 2026		Not yet due

What triggers a reclassification

Trigger	Usually moves	What to do
RT-01 A new purpose, audience or recipient, including a new supplier	Either	Rate the three impacts again before the information is shared.
RT-02 Information combined, exported or reported in bulk	Up	Rate the combination (CL-13); a bulk export may need a higher level than its parts.
RT-03 Personal or special category data added	Up	Add the marker (CL-07); special category or data at scale makes it Confidential (CL-14).
RT-04 An incident, near miss or handling check that shows the impact was underrated	Up	Contain and report through the incident pack (CL-18), then reassess the affected asset and its copies.
RT-05 A change in law, regulation or a contract	Either	Check the level, the retention period and the handling rules with the privacy adviser and Legal.
RT-06 The owner approves public release	Down	Record the release decision (CL-05); the released version becomes Public, the working files keep their level.
RT-07 An embargo or announcement date passes	Down	Lower the level from that date, as the owner recorded when classifying.
RT-08 Information anonymised, or reduced to statistics no one can be identified from	Down	The new version is rated on its own; the source keeps its level.
RT-09 The commercial sensitivity lapses: a price list replaced, a contract ended, a bid decided	Down	The owner lowers the level, with the reason (CL-10), or the retention schedule ends it.
RT-10 The annual review	Either	Confirm the level, owner, location, markers and retention (CL-12).

Assessment summary

Calculated from the Classification assessment sheet. The owner's decisions go into the Information Asset Register; the headline measures are reported from there.

As-at date

30 Sep 2026

EXAMPLE: the example quarter end. Action statuses on the Reclassification sheet are measured at this date; use today's date, or type =TODAY().

Counts

Count	Assets	What it means
Owner decided: Public	2	All impacts Low and release approved (CL-05).
Owner decided: Internal	7	The highest impact Medium, or all Low without a release (CL-04).
Owner decided: Confidential	7	Any impact High.
Awaiting the owner's decision	1	Handled as Internal meanwhile (CL-04).
Highest rating High	7	Assets whose worst property is High.
Highest rating Medium	6	Assets whose worst property is Medium.
Highest rating Low	3	Assets whose worst property is Low.
Owner's level differs from the ratings	0	Each needs its reason recorded (CL-02).
Carry the Personal data marker	5	Data protection law applies whatever the level (CL-07).
Carry the Special category marker	1	Always Confidential (CL-14).
Rows with a check to resolve	1	Every Check should say OK, or the owner is still deciding.

A spread across the levels is a sign the decision is being made from harm, not habit: Confidential for everything makes the label meaningless (CL-02).

Level	YesNo	RatingOfLevel
Public	Yes	Low
Internal	No	Medium
Confidential		High

High

Definitions

Term	Meaning in this workbook
Classification	The owner's decision on how much protection an information asset needs, made from the harm that unauthorised disclosure, unauthorised change or loss of availability could cause.
Information asset	A body of information managed as one unit, with one owner and one purpose, such as the customer accounts and order history. Its copies, exports and extracts are part of it unless the owner records them as an asset of their own.
Impact level (1 to 4)	The risk scale's impact levels: 1 Minor, 2 Moderate, 3 Major, 4 Severe.
Impact rating	Low, Medium or High: the harm one of confidentiality, integrity or availability could suffer, read from the risk scale's impact levels (Low is Minor, Medium is Moderate, High is Major or Severe).
Highest justified level	The level is the highest that any one of confidentiality, integrity or availability justifies, and no higher. An owner who chooses a higher level records why. Value is not harm: information is not Confidential because it is important.
Aggregation	Combining information so that the whole could cause more harm than any part: every customer's prices in one file, or a rota joined to absence reasons.
Marker	A word added to the level where a law or a duty adds rules of its own: Personal data, Special category or Legal hold. A marker never lowers a level.
Personal data	Information relating to an identified or identifiable living person (GDPR). It is protected under data protection law whatever its level, and the level never decides whether processing it is lawful.
Special category data	Personal data that reveals racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, genetic or biometric data used to identify a person, or data concerning health, sex life or sexual orientation (GDPR Article 9).
Release	The owner's recorded decision that information may be given to anyone. Only release makes information Public.
Reclassify	To change the level after a change in purpose, content, audience, law, contract or after an incident, with the reason recorded.
Declassify	To lower a level. Only the owner does it, with a recorded reason.
Information owner	The manager accountable for an information asset: decides its level, who may access it, how long it is kept and when it is released or destroyed.
CL-nn, RT-nn	The rules of the Information Classification & Handling Policy and the reclassification triggers of the Classification & Labelling Procedure.
(calc)	A cell or column the workbook calculates. Do not type or paste over it.
EXAMPLE	A worked example: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders, as at 2026-09-30. Delete the EXAMPLE rows and working before approval.

IA-02 Customer price lists and discount terms

First rated, and the level then

19 Aug 2026: Internal

17 Sep 2026, by the Head of Information Security, in the quarterly handling check

What was found

The monthly export of every customer's prices and discounts was saved on a sales team site that all 900 staff could open, labelled Internal. Each customer receives its own price list, so confidentiality and integrity had been rated Medium for one list, not for every list together.

17 Sep 2026, by the Sales Director

CL-13: A collection, export, report or copy takes the highest level of anything in it, and a higher level where combining the items raises the impact.

Framework references

These references indicate relevance only and do not reproduce the text of any standard.

Framework	Reference	Supported by
ISO/IEC 27001:2022	Annex A 5.12 — Classification of information	Classification assessment: each asset's level from its confidentiality, integrity and availability impacts
NIST CSF 2.0	ID.AM-05 — “Assets are prioritized based on classification, criticality, resources, and impact on the mission”	Classification assessment and Summary: assets prioritised by classification and impact
NIS2 — Directive (EU) 2022/2555	Article 21(2)(i) — “human resources security, access control policies and asset management”	The whole workbook: classification as part of asset management
NIS2 — Implementing Regulation (EU) 2024/2690	Article 1 — lays down the technical and methodological requirements of the Article 21(2) measures, and further specifies when an incident is significant, for DNS service providers, TLD name registries, cloud computing, data centre and content delivery network providers, managed service and managed security service providers, providers of online marketplaces, online search engines and social networking services platforms, and trust service providers	Who the Implementing Regulation binds; for other entities it shows what the regulator expects
NIS2 — Implementing Regulation (EU) 2024/2690	Annex, point 12.1.2 — the relevant entities shall “(a) lay down a system of classification levels for assets; (b) associate all assets with a classification level, based on confidentiality, integrity, authenticity and availability requirements, to indicate the protection required according to their sensitivity, criticality, risk and business value; (c) align the availability requirements of the assets with the delivery and recovery objectives set out in their business continuity and disaster recovery plans.”	Impact criteria and Classification assessment: every asset given a level from its confidentiality, integrity and availability requirements
DORA — Regulation (EU) 2022/2554	Article 8(1) — identify, classify and document ICT-supported business functions, information assets and ICT assets, reviewed at least yearly	Classification assessment and Reclassification: information assets classified, and the classification reviewed
GDPR — Regulation (EU) 2016/679	Article 9(1) — “Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation shall be prohibited.”, unless one of the conditions of Article 9(2) applies	The Special category marker: special category data always Confidential (CL-14)
GDPR — Regulation (EU) 2016/679	Article 32(2) — in assessing the appropriate level of security, account is taken of the risks presented by processing	Impact criteria: the Data area weighs the risk to the people the data is about

Editions referenced: ISO/IEC 27001:2022 incl. Amd 1:2024; NIST CSF 2.0; Directive (EU) 2022/2555 (NIS2) and Implementing Regulation (EU) 2024/2690; Regulation (EU) 2016/679 (GDPR); Regulation (EU) 2022/2554 (DORA) and Delegated Regulation (EU) 2024/1774

ISO/IEC 27001 references name the clause or control this document relates to. They do not say that meeting it meets any other framework's requirement.