Information Classification & Handling Policy
Sets the classification levels, ownership duties and handling obligations; the data-protection domain's single policy.
Available soon
- Format
- Word
- Size
- 69 KB
- Length
- 22 pages
- Version
- 2.0
- Updated
What's inside
What changed
- 2.0
Rewritten to the depth of the other CISO Times packs: the levels now come with their meaning, labels and examples; impact is read from the risk scale; the decision has its special cases and worked decisions; rules CL-13 to CL-20 are added; every statement names its evidence; roles, measures, exceptions and a worked example of the first quarter are added.
- 1.0
Published.
Preview
The document from section 1, as you will receive it. Highlighted [[text]] is for you to replace; shaded guidance boxes are for you to delete before approval. The cover and document control pages are in the file.
Purpose
This policy commits [[Organisation Name]] to protecting each piece of information as much as the harm its loss, change or disclosure could cause, and no more. Every information asset has an owner. The owner gives it one of three levels, from the harm that could follow if the wrong person saw it, if it were changed without authority, or if it could not be used when needed. The level then tells everyone what to do when they store, share, print, take home, put into an AI tool, keep or throw away that information.
It aims to avoid the two ways classification usually fails: nothing labelled, so everyone decides for themselves what may be emailed; or everything labelled Confidential, so the label stops meaning anything. Most information is Internal and stays there. Confidential is kept for the information whose harm is material, and for that information the rules are strict.
The Classification Level Handling Rules Matrix says what each level requires for every action, the Classification & Labelling Procedure says how an owner decides and how labels are applied, and the Information Asset Register lists every asset with its level. The rules below are the part that does not change from one system to the next.
Guidance — delete before approval
This is the policy for topic PT-04, asset management and information classification, in the Security Policy Management pack's list of policy topics. It is a Policy-tier document: approved by executive management and reviewed at least every 12 months.
Keep the three levels and their names. Every label, register, system setting and briefing in the pack uses them, and a fourth level added in one place and not the others is the commonest way a scheme stops working.
Scope
This policy applies to:
- Information: everything [[Organisation Name]] creates, receives or keeps that has value to it, in any form: files, records in a system, email and messages, paper, recordings, conversations and what people know.
- Systems and media: every system, device and medium that holds that information, including cloud services, laptops, phones, removable media, printers with storage and paper files. A system or medium takes the level of the most sensitive information it holds.
- Suppliers: information held, processed or received by a supplier on our behalf, under the contract terms of the third-party security pack.
- People: everyone who reads, creates or handles our information: employees, contractors, temporary staff and suppliers' staff.
Excluded: [[anything deliberately left out, and where it is covered instead, e.g. information classified under a customer's own scheme, which follows that scheme by contract; or "None"]].
Guidance — delete before approval
Information a customer or partner gives you under its own classification scheme follows that scheme where the contract says so. Map its levels to yours in the Classification Level Handling Rules Matrix and handle it at the higher of the two.
Personal data is in scope like any other information, and is also protected by data protection law whatever its level (CL-07). This policy does not decide whether processing personal data is lawful; the privacy policy and the Data Protection Officer do.
Classification levels
There are three levels. Every information asset has exactly one. New business information starts at Internal (CL-04).
Level | What it means | When it applies | Label |
|---|---|---|---|
Public | Approved for public release. No confidentiality restriction remains. | The owner has approved release to anyone, and every impact is Low. | None needed; "Public" where it helps a reader. |
Internal The default | For the organisation and approved suppliers. Unauthorised disclosure could cause limited harm. | The highest impact is Medium, or every impact is Low but release has not been approved. All new business information starts here. | "Internal" where the medium supports it. Unlabelled business information is treated as Internal. |
Confidential | Restricted to named roles or recipients. Unauthorised disclosure, change or loss could cause material harm. | Any of confidentiality, integrity or availability is rated High. | "Confidential" always, on every page, file, message and copy. |
Examples of each level:
Level | Typical examples |
|---|---|
Public | Published product catalogue and website pages; Press releases and the published annual report; Job advertisements once published |
Internal | Policies and procedures; Warehouse stock levels and dispatch plans; Sales forecasts and marketing plans; Shift rotas (with the Personal data marker) |
Confidential | Customer accounts, order history and price lists; Payroll, staff bank details and HR records; Supplier bank details; Board papers |
Internal is the default. Information whose owner has not yet decided is handled as Internal. So is business information that carries no label. Public information must have an owner-approved release decision. A lack of a label never makes information Public.
Public is a decision. Information becomes Public only when its owner approves release to anyone. Low harm is not enough on its own: a page of answers to customer questions may harm no one if seen, but until the owner releases it, it is Internal.
Confidential is for material harm. Information is Confidential when any one of confidentiality, integrity or availability is rated High. Value is not harm: information is not Confidential because it is important, took effort to produce, or belongs to a senior person.
Markers
A marker adds the rules of a law or a duty to the level. A marker never lowers a level.
Marker | Applies to | What it adds |
|---|---|---|
Personal data | Any personal data, at any level. | Data protection law applies whatever the level (CL-07): a lawful basis, purpose limits, retention no longer than necessary, the GDPR breach route through the incident pack (CL-18), and processor terms for any supplier that processes it (P06 clause CL-06). |
Special category | Special category personal data (GDPR Article 9), always with the Confidential level. | Access by named people only; never printed outside the office, taken on removable media or put into an AI tool; the Data Protection Officer consulted before any new use or sharing. |
Legal hold | Information Legal has placed under a hold, at any level. | Not changed, deleted or disposed of until Legal releases the hold in writing, whatever the retention schedule says (CL-15). |
Guidance — delete before approval
The examples are a distributor's. Replace them with your own, and keep at least two per level: people classify by comparison with examples far more than by reading definitions. The Classification Quick-Reference Card & Staff Briefing carries the everyday version for staff.
Decision method
The owner rates three impacts, each against the harm the information could do as it is, before the controls that protect it. Use the highest level justified by the confidentiality, integrity or availability impact, each rated on the risk scale's impact levels. Do not label everything Confidential by default: value is not harm.
Impact | The question the owner asks |
|---|---|
Confidentiality | What harm if the wrong person saw it? |
Integrity | What harm if it were changed without authority, or wrong? |
Availability | What harm if it could not be used when needed? |
Each impact is rated Low, Medium or High. The rating is read from the impact levels of the Risk Assessment Methodology & Scoring Model (Information Security Risk Management pack), so a classification and a risk assessment judge the same harm the same way. There is no second scale.
Rating | The risk scale's impact levels |
|---|---|
Low | Minor |
Medium | Moderate |
High | Major or Severe |
Taking the level
Answer the questions in order and stop at the first that settles it.
Question | If yes | If no |
|---|---|---|
Have all three impacts been rated? | Next question. | Handle it as Internal and ask the owner to decide (CL-04). |
Is any impact High? | Confidential. | Next question. |
Is the highest impact Medium? | Internal. | Next question: every impact is Low. |
Has the owner approved release to anyone? | Public (CL-05). | Internal, until the owner approves release. |
Then add the markers that apply. The owner approves the level, records the reason in the register, and sets the next review date (CL-03, CL-12). An owner may choose a higher level than the ratings give, and records why; nobody chooses a lower one.
Impact criteria
What each rating means in practice, area by area. Judge each of the three impacts against every area and take the worst. The full criteria, with examples, are in the Information Asset Classification Workbook.
Area | Low (Minor) | Medium (Moderate) | High (Major) | High (Severe) |
|---|---|---|---|---|
Financial | less than [[€50,000]] | [[€50,000]] to [[€250,000]] | [[€250,000]] to [[€1,000,000]] | more than [[€1,000,000]] |
Service | an internal service degraded for hours | a customer service degraded, or an internal service stopped, for up to [[1]] day | a core customer service stopped for up to [[2]] days | a core customer service stopped for more than [[2]] days |
Data | internal, non-personal data | internal confidential data, or personal data of a few people | personal or customer data of [[hundreds]] of people, or commercially sensitive data | personal or customer data at scale |
Legal and regulatory | no notification or breach | a minor breach of contract or policy, put right without penalty | a formal enquiry by a regulator or customer, or a contract breach with penalties | a notifiable breach, enforcement or contract termination |
Reputation | not noticed outside the team | noticed by some customers or suppliers | complaints from several major customers, or regional or trade press | national press, or loss of a major customer |
Special cases
Case | Rule | What it means |
|---|---|---|
Highest justified level | CL-02 | The level is the highest that any one of confidentiality, integrity or availability justifies, and no higher. An owner who chooses a higher level records why. Value is not harm: information is not Confidential because it is important. |
Aggregation | CL-13 | A collection, export or report takes the highest level of anything in it. Where combining items raises the harm, the owner rates the combination: one customer's price list goes to that customer, but every customer's prices in one file is Confidential. |
Personal data | CL-07 | Personal data carries the Personal data marker at every level, and data protection law applies whatever the label. A shift rota with names is Internal with the marker; the label does not decide whether processing is lawful. |
Special category data | CL-14 | Special category data, and personal or customer data at scale, are always Confidential. The risk scale rates personal or customer data at scale Severe in its Data area, and this pack rates special category data the same for any number of people. |
Legal hold | CL-15 | A legal hold adds the Legal hold marker and stops deletion and disposal until Legal releases it in writing. It does not change the level. |
Copies and exports | CL-09 | A copy, export, print or extract keeps the level of its source, carries its label, and is deleted when it is no longer needed. |
Systems and media | CL-01 | A system, device or medium takes the highest level of the information it holds, and is protected and disposed of at that level. |
Worked decisions
EXAMPLE, from the register of a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders, as at 30 Sep 2026. One asset for each kind of outcome.
Asset | Confidentiality | Integrity | Availability | Level and why |
|---|---|---|---|---|
IA-03 Online orders and customer sign-in accounts | High (Severe) | High (Major) | High (Severe) | Confidential. An impact is High (CL-02). Takes 60% of orders; customer accounts at scale; an outage of more than 2 days is the risk register's R-01. |
IA-06 Supplier master data and bank details | Medium (Moderate) | High (Major) | Medium (Moderate) | Confidential. An impact is High (CL-02). A changed bank detail diverts a payment run: the risk register's R-02, and the attempt in the incident pack's INC-2026-015. Integrity sets the level. |
IA-02 Customer price lists and discount terms | High (Major) | High (Major) | Medium (Moderate) | Confidential. An impact is High (CL-02). Every customer's prices and discounts together would let a competitor undercut bids and customers reopen terms; a price changed in bulk is invoiced wrongly. |
IA-09 Warehouse shift rotas | Medium (Moderate) | Low (Minor) | Medium (Moderate) | Internal. The highest impact is Medium (CL-02). Staff names and shifts: personal data with limited harm. Internal with the Personal data marker (CL-07). |
IA-14 Customer service scripts and answers to common questions | Low (Minor) | Low (Minor) | Low (Minor) | Internal. Every impact Low, but never released: Internal (CL-04, CL-05). |
IA-15 Published product catalogue and website pages | Low (Minor) | Low (Minor) | Low (Minor) | Public. Every impact is Low and the owner approved release (CL-05). Release approved by the owner; prices are shown only after sign-in, from IA-02. |
IA-17 Freight rates and quotes on the rate comparison site | Not rated | Not rated | Not rated | Internal. Awaiting the owner's decision: handled as Internal meanwhile (CL-04). |
Guidance — delete before approval
IA-06 is Confidential on integrity alone: nothing in it harms anyone if seen, but a changed bank detail diverts a payment run. IA-14 shows the default at work: every impact is Low, but no one has released it, so it stays Internal.
Policy statements
The statements keep the rule IDs CL-01 to CL-20 that every document in the Information Classification & Handling pack cites. Values in [[brackets]] are the pack's defaults; set your own before approval. Each statement names the evidence an auditor looks at.
Classifying information
CL-01 Classify information, and the system or medium that holds it, before it is used, shared or retained. A system or medium takes the highest level of the information it holds.
Evidence: a register entry for every information asset, naming the systems, sites, media and regular exports that hold it, with its level recorded before it was first used or shared.
CL-02 Use the highest level justified by the confidentiality, integrity or availability impact, each rated on the risk scale's impact levels. Do not label everything Confidential by default: value is not harm.
Evidence: for each asset, the three impact ratings with the risk scale's impact level behind each and the reason; where the owner chose a higher level than the ratings give, the owner's reason.
CL-03 Information owners approve the level and review it when the purpose, users, law, a supplier or the risk changes, within [[15]] working days of the change.
Evidence: the owner's approval and its date in the register; for each material change, a review within the working days the statement sets, or the asset shown as awaiting the owner's decision.
CL-04 The default for new business information is Internal until its owner records a different decision. Information whose classification is incomplete is handled as Internal.
Evidence: register entries awaiting a decision shown as held Internal; nothing found in a handling check treated as Public without a release decision.
CL-05 Public information must have an owner-approved release decision. A lack of a label never makes information Public.
Evidence: a release decision for every Public asset, naming the owner, the date and the version released.
CL-13 A collection, export, report or copy takes the highest level of anything in it, and a higher level where combining the items raises the impact.
Evidence: for every regular export, report or collection in the register, its own rating, made for the combination.
CL-14 Special category personal data, and personal or customer data at scale, are always Confidential, and carry the Personal data and, where it applies, the Special category marker.
Evidence: every asset with the Special category marker, or holding personal or customer data at scale, recorded as Confidential with access limited to named people or approved role profiles.
Handling and labelling
CL-06 Apply the handling rule for the level to every action: storing, accessing, sharing inside and outside the organisation, transferring, printing, remote and mobile working, AI tools, retaining and disposing.
Evidence: the handling matrix, approved at its tier; the results of each quarterly handling check against it.
CL-08 Confidential information is shared only with an approved recipient for a recorded purpose, using an approved channel, with the recipient's address checked before sending.
Evidence: for each recipient outside the organisation of Confidential information, the owner's approval, the recorded purpose and the channel used; the email system's warning for external recipients.
CL-09 Use a visible label where the medium supports it, and carry the level into exports, copies, prints and meeting materials. Confidential is always labelled.
Evidence: labels seen in the quarterly handling check; the sensitivity label settings of the email and document systems; reports and exports of Confidential assets labelled at the source.
CL-19 Information goes into an AI tool only where the tool is approved for its level: Public into any tool; Internal and Confidential only into tools the organisation has approved for that level, under a contract that bars using its data to train models. Special category data never.
Evidence: the list of AI tools approved for each level, each with the contract term that bars using the organisation's data to train models.
Personal data, retention and legal holds
CL-07 Personal data is protected under data protection law (GDPR) regardless of the classification label, and carries the Personal data marker. The label does not decide whether processing is lawful.
Evidence: the Personal data marker on every asset that holds personal data; the privacy adviser's advice where it was asked for; the cross-reference to [[the record of processing activities]].
CL-11 Dispose of information and media using the level's disposal rule and the method for the media type. Keep a certificate for every Confidential item a provider sanitises or destroys, due within [[10]] working days of collection, and a disposal record for every item destroyed in house.
Evidence: the retention rule of each asset in the register; a certificate or disposal record for every item that held Confidential information, reconciled item by item with its collection manifest.
CL-15 Information under a legal hold is not changed, deleted or disposed of, whatever its retention period, until Legal releases the hold in writing. Disposal checks for a hold first.
Evidence: the list of legal holds with their start and release dates; the hold check made before every disposal.
Suppliers and access
CL-16 A supplier stores, processes or receives Internal or Confidential information only under contract terms that protect it (P06 clause CL-01, P06 clause CL-07, P06 clause CL-13, and P06 clause CL-06 where it processes personal data). Confidential information goes to a supplier only after its assessment under the third-party pack has ended in a documented decision to approve it (P06 TP-05).
Evidence: for each supplier that holds Internal or Confidential information, its third-party reference, its tier and the signed clauses; for Confidential information, the assessment completed before the information was sent.
CL-17 Access to Confidential information is granted only through an approved role profile or approved non-standard access with an expiry (P13 JML-03, JML-04), is reviewed in every access review (P07 AR-02), and administrator access to systems that hold it follows the privileged access pack (P14 PA-02, PA-06, PA-07).
Evidence: access granted through role profiles, or non-standard access approved with an expiry; access review results; the privileged access records of the systems that hold Confidential information.
Change, review and mishandling
CL-10 Reclassify when a change in purpose, content, audience, incident or contract changes the impact. Only the owner lowers a level, with the reason recorded.
Evidence: a reclassification record for every change of level, with its trigger, reason, date and owner.
CL-12 Information owners and custodians review the register at least every [[12]] months and after a material change.
Evidence: the last and next review dates of every asset in the register, and the measure of reviews on time.
CL-18 Suspected mishandling, loss, or Confidential information found unlabelled or in the wrong place is reported at once through the incident reporting route (P09 IM-01). A suspected personal data breach follows the incident pack's GDPR reporting duties (RD-06 to RD-09).
Evidence: incident records whose cause was mishandling, with the reassessment of the asset after containment; the measure of mislabelled or mishandled information incidents.
Exceptions and reporting
CL-20 Any departure from these rules is a P02 exception, scored and approved by the approver its band sets (EX-05); a Critical exception is approved by the board or its equivalent. The headline measures go monthly to the security and IT leadership team.
Evidence: the exception register's entries against these rules, each scored and approved at its band; the monthly report of the four headline measures.
Handling at each level
What the levels mean for the actions people take most often. The Classification Level Handling Rules Matrix sets the rule for every action at every level (CL-06).
Action | Public | Internal | Confidential |
|---|---|---|---|
Store | The approved public location, with the master copy in managed storage so the published copy can be checked and restored. | Managed organisation storage with access control: the organisation's business systems, file storage and email. Not in personal accounts or on unmanaged devices. | Managed storage that encrypts at rest, in a location limited to named people or approved role profiles. Never in personal accounts, on unmanaged devices, or on removable media without the owner's approval and encryption. |
Share externally | The released version only. | With approved suppliers and partners that have a business need, under a contract with confidentiality terms (P06 clause CL-01). Check the recipient's address before sending. | Only to a recipient the owner has approved for the recorded purpose, under a contract or confidentiality agreement; to a supplier only after its assessment has approved it (P06 TP-05) and under P06 clause CL-01, P06 clause CL-07 and, for personal data, P06 clause CL-06. By an encrypted, expiring share link or an encrypted file, with the address checked against a trusted record, never typed from memory or picked from autocomplete. |
No restriction. | Only when needed; collect at once, using secure print release where the printer has it. | Only when necessary, through secure print release, labelled on every page. Never left on a printer or desk; every copy shredded when no longer needed. | |
AI tools | Any tool. | Only AI tools the organisation has approved for Internal [[list]], signed in with the work account, under a contract that bars using its data to train models. | Only AI tools the organisation has approved for Confidential [[list, which may be none]], under a contract assessed under the third-party pack that bars using its data to train models. Never a personal or free tool. Special category data never. |
Dispose | Delete when no longer needed. | Secure deletion from managed storage; media cleared or purged by the media method; paper shredded or put in the confidential waste console. | Secure deletion or sanitisation: media purged or destroyed by the media method; retain a certificate or disposal record for every item. Check for a legal hold first. |
Guidance — delete before approval
CL-01 to CL-12 are the rules published at version 1.0, with their IDs and meaning kept. CL-13 to CL-20 were added at 2.0. Do not renumber them. If you remove one, keep its number and mark it "Withdrawn in version x.y", so records that cite it still point to the right text.
Set the bracketed values once, here, and use the same values in the matrix, the procedure, the register and the card. The certificate window in CL-11 is the confirmation window the third-party pack sets for deletion at the end of a contract, so a supplier is held to the same time either way.
Roles and responsibilities
Every information asset has one information owner, recorded by role in the register. The four roles every asset needs are the information owner, the custodian, the user and the Head of Information Security; the privacy adviser and the records manager advise and keep records.
Role | Responsibilities under this policy |
|---|---|
Executive management [[e.g. Executive Committee, or the management body]] | Approves this policy. Receives any headline measure outside tolerance with its plan (CL-20). |
Information owner [[e.g. system owner or the head of the function the information serves]] | Approves the level, the purpose, who may access it, the retention period and any release; reviews the classification; approves non-standard access to it (P13 JML-04). |
Custodian [[e.g. Head of IT, system administrator or the supplier that hosts it]] | Applies the technical handling the level requires: access, encryption, backup, logging, labelling in the system, and disposal. |
User [[everyone: staff, contractors and supplier staff]] | Follows the label and the handling rule, checks recipients before sending, and reports suspected mishandling at once. |
Head of Information Security [[e.g. Head of Information Security]] | Owns this policy and the handling matrix, advises on impact, runs the handling checks and reports the measures. |
Data Protection Officer [[or the privacy lead where no DPO is appointed]] | Advises on personal and special category data, retention of personal data and any personal data breach. |
Records manager [[e.g. Company Secretary or Head of Legal]] | Keeps the retention schedule and the disposal records, and applies and releases legal holds on Legal's instruction. |
The Information Ownership Responsibility Matrix sets out who is responsible, accountable, consulted and informed for each activity under these rules. A Critical exception to any of them is approved by the board or its equivalent: the board, or a board risk committee it has delegated this to; in a two-tier structure, the management board; where there is no board, such as in an owner-managed company, executive management.
Guidance — delete before approval
For a system's own data, the information owner is usually the system owner of the access review pack (User Access Review) and the custodian its system administrator. Use the same people: one person should not own a system for access reviews and someone else own its data for classification.
Name an owner by role, never a team or a committee. An asset whose owner leaves is owned by the owner's line manager until a new owner is recorded, and stays at its level meanwhile.
Compliance and consequences
How compliance is checked. Each quarter the Head of Information Security checks a sample of [[5]] Confidential assets where they are actually held: who can reach them, how they are labelled and shared, and whether exports exist the register does not show. The Head of Information Security also checks a sample of disposal certificates against their manifests each quarter, and reconciles the register with the systems inventory [[every six months]]. [[Internal audit]] tests the policy [[every year]], including at least one Confidential export and one disposal.
Measures. Every measure goes monthly to the security and IT leadership team; ICM-03 and ICM-04 count the quarter. A measure outside tolerance goes to the next executive committee with its plan.
Measure | What it counts | Target |
|---|---|---|
ICM-01 Information assets classified with an owner | Register entries with a named owner and an owner-approved level at the period end, out of all register entries. | All |
ICM-02 Classification reviews on time | Classified assets whose last review is within 12 months and after their last material change, or still within the 15 working days a change allows, at the period end, out of all classified assets. | All |
ICM-03 Mislabelled or mishandled information incidents | Incidents declared under the incident pack in the quarter whose root cause was information labelled lower than its level or handled against its level's rule. | Zero |
ICM-04 Disposal certificates held | Items that held Confidential information disposed of in the quarter with a matching certificate or disposal record, out of all such items. | All |
Consequences of not complying. Nobody is disciplined for a mistake they report at once, or for a report made in good faith (CL-18). Deliberately lowering a level to make sharing easier, removing a label, sending Confidential information to a personal account, or hiding a loss may lead to action under the [[disciplinary procedure]]. For a supplier, mishandling our information is a breach of the security terms of its contract, handled under them.
Guidance — delete before approval
EXAMPLE, as at 30 Sep 2026, with the tolerances the security and IT leadership team set:
ICM-01: 16 of 17 assets (94%): below target, within tolerance; IA-17 awaits its owner's decision.
ICM-02: 15 of 16 reviews on time: below target, within tolerance; IA-09 was due by 28 Sep 2026, after a material change on 7 Sep 2026.
ICM-03: 1 incident (INC-2026-016): below target, within tolerance, the tolerance being [[1 a quarter, each with its root cause fixed]].
ICM-04: 28 of 29 items certified: outside tolerance, because every item must be accounted for. It goes to the executive committee with its plan.
Exceptions
Any departure from these rules is requested, scored and approved under the Security Exception & Waiver Standard [[document ID]] (Security Exception, Waiver & Segregation of Duties pack), using the Security Exception Request & Approval Form, before the departure begins (CL-20). An exception names the rule, the asset, the reason, the compensating measures and an expiry date, and is recorded in the Security Exception Register. Agreement by email, in a meeting or by a manager is not an exception.
An exception can change how a rule is met for a named asset and a fixed time, such as an older device that cannot be encrypted until it is replaced. It never changes a legal duty: personal data is protected under data protection law, a legal hold is kept, and a personal data breach is reported, exception or not. Information is never declassified to avoid an exception.
Guidance — delete before approval
EXAMPLE: Confidential customer delivery lists stay on the six unencrypted laptops at the smaller warehouse site until the March 2027 refresh, under the conditions of the risk acceptance RA-01 (P05 R-12); the refresh brings them onto encrypted devices. The plan, with its date, is recorded against CL-06 in the register for IA-01; a later start date on an approved plan is not an exception while the plan holds. If the refresh slips beyond 31 Mar 2027, it becomes one.
Related documents
Document | Relationship |
|---|---|
Classification Level Handling Rules Matrix | The handling rule for every action at every level (CL-06, CL-08, CL-19) |
Classification & Labelling Procedure | How an owner classifies, labels each medium, reclassifies and reports mishandling (CL-01 to CL-05, CL-09, CL-10) |
Information Asset Register | Every information asset, with its owner, level, markers, access, retention and review dates (CL-01, CL-03, CL-12) |
Information Asset Classification Workbook | The impact criteria and the rating of each asset (CL-02, CL-13, CL-14) |
Secure Information Disposal Checklist | Disposal by media type, the certificate and its reconciliation (CL-11, CL-15) |
Classification Quick-Reference Card & Staff Briefing | The everyday version for staff, and the briefing that introduces it |
Information Ownership Responsibility Matrix | Who is responsible, accountable, consulted and informed for each activity |
Risk Assessment Methodology & Scoring Model | The impact scale the ratings are read from; Information Security Risk Management pack |
Supplier Contract Security Clause Library; Supplier Criticality & Tiering Model | The clauses and the assessment a supplier needs before it holds our information (CL-16); Third-Party Security Risk Management pack |
Access Control Policy; Role-Based Access Profile Matrix | Role profiles and non-standard access (CL-17); Joiner-Mover-Leaver & Access Provisioning pack |
Privileged Access Standard | Administrator access to systems that hold Confidential information (CL-17); Privileged Access Management pack |
Access Review Methodology | Access reviews of Confidential information (CL-17); User Access Review pack |
Security Incident Management Policy; Personal Data Breach Response Playbook | Reporting mishandling, and the personal data breach route (CL-18); Security Incident Management pack |
Security Exception & Waiver Standard | The route for every exception to this policy (CL-20); Security Exception, Waiver & Segregation of Duties pack |
[[Information Security Policy]] | [[Parent policy]] |
[[Privacy policy and record of processing activities]] | [[Whether processing personal data is lawful; what is processed and why]] |
[[Records retention schedule]] | [[How long each type of record is kept (CL-11)]] |
Definitions
Term | Meaning in this policy |
|---|---|
Information | Anything the organisation creates, receives or keeps that has value to it, in any form: files, records in a system, email, paper, conversations and what people know. |
Information asset | A body of information managed as one unit, with one owner and one purpose, such as the customer accounts and order history. Its copies, exports and extracts are part of it unless the owner records them as an asset of their own. |
Classification | The owner's decision on how much protection an information asset needs, made from the harm that unauthorised disclosure, unauthorised change or loss of availability could cause. |
Level | One of the three classification levels: Public, Internal or Confidential. |
Impact rating | Low, Medium or High: the harm one of confidentiality, integrity or availability could suffer, read from the risk scale's impact levels (Low is Minor, Medium is Moderate, High is Major or Severe). |
Marker | A word added to the level where a law or a duty adds rules of its own: Personal data, Special category or Legal hold. A marker never lowers a level. |
Label | The visible sign of the level on the information itself: a subject-line tag, a header, a sensitivity label, a stamp or a spoken warning. |
Handling rule | What the level requires for one action, such as storing, sharing, printing or disposing of the information. |
Aggregation | Combining information so that the whole could cause more harm than any part: every customer's prices in one file, or a rota joined to absence reasons. |
Personal data | Information relating to an identified or identifiable living person (GDPR). It is protected under data protection law whatever its level, and the level never decides whether processing it is lawful. |
Special category data | Personal data that reveals racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, genetic or biometric data used to identify a person, or data concerning health, sex life or sexual orientation (GDPR Article 9). |
Information owner | The manager accountable for an information asset: decides its level, who may access it, how long it is kept and when it is released or destroyed. |
Custodian | The person or team that holds and runs the information for the owner, usually IT or a supplier: applies the access, storage, backup and disposal controls the level requires. |
User | Anyone who reads, creates or handles the information, staff or supplier: follows the label and the handling rule, and reports mistakes. |
Release | The owner's recorded decision that information may be given to anyone. Only release makes information Public. |
Reclassify | To change the level after a change in purpose, content, audience, law, contract or after an incident, with the reason recorded. |
Declassify | To lower a level. Only the owner does it, with a recorded reason. |
Retention schedule | The organisation's list of how long each type of record is kept and why, kept by the records manager. |
Legal hold | An instruction from Legal to keep named information unchanged, whatever its retention period, because of a claim, an investigation or an authority's request. |
Sanitise | To make information on a medium impossible to recover, by one of the three methods of NIST Special Publication 800-88 (Guidelines for Media Sanitization): clear, purge or destroy. |
Certificate | A provider's signed record that named items, listed by serial number, were sanitised or destroyed, by which method, when and by whom. |
Mishandling | Handling information against its level's rule: sending it to the wrong person, storing it in the wrong place, losing it, leaving it unattended, or labelling it lower than its level. |
Document control
Approval record
Version | Approved by | Date | Evidence of approval | Next review by |
|---|---|---|---|---|
[[1.0]] | [[Executive management]] | [[YYYY-MM-DD]] | [[e.g. minutes of meeting, reference and item]] | [[YYYY-MM-DD]] |
Review. This policy is reviewed at least every 12 months, and sooner after: a major incident, or an incident the document should have prevented; a material change to the organisation's activities, systems or suppliers; a change in law, regulation or a contract the document supports; an audit or assessment finding against the document; a significant change in the threats the document addresses. A handling incident whose cause was a rule missing or wrong in this policy always triggers a review.
Publication. The current approved version is published at [[location everyone in scope can reach]]. The quick-reference card is published beside it, and given to every new starter and to supplier staff who handle Internal or Confidential information.
Guidance — delete before approval
This is a Policy-tier document: approved by executive management. Nobody approves a document they own or wrote: if the owner sits on the approving body, the rest of it approves.
Worked example: the first quarter
EXAMPLE, not part of the policy. The organisation is the one used throughout the pack: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders, an important entity under NIS2 in its Member State. Replace it with your own, or delete this section before approval.
Date | What happened | Rule |
|---|---|---|
14 Jul 2026 | This policy approved by the Executive Committee, at the Policy tier, owned by the Head of Information Security. | PT-04 |
12 Aug 2026 | Legal hold LH-2026-01 placed on evidence of the ransomware incident INC-2026-014: the images of the 14 Warehouse 2 office PCs taken before they were rebuilt, and the incident's logs. | CL-15 |
28 Aug 2026 | Register built from the systems inventory and the supplier register: every asset with an owner, rated and classified by its owner. | CL-01, CL-03 |
7 Sep 2026 | IA-09, warehouse shift rotas, moved into a new system: a material change, due for review within 15 working days. | CL-03 |
9 Sep 2026 | INC-2026-016: customer order spreadsheet sent to the wrong business customer. Reported through the incident route and handled as a personal data breach. | CL-08, CL-09 |
15 Sep 2026 | IA-17, freight rates and quotes on the rate comparison site, found by discovery. Handled as Internal until its owner decides. | CL-04 |
17 Sep 2026 | Handling check: the monthly export of every customer's prices and discounts was saved on a sales team site that all 900 staff could open, labelled Internal. Each customer receives its own price list, so confidentiality and integrity had been rated Medium for one list, not for every list together. The Sales Director re-rated it Confidential the same day. | CL-13 |
21 Sep 2026 | Certificate for DS-2026-10 received: 23 of 24 laptops. LT-0417 chased on 22 Sep 2026; to be accounted for by 6 Oct 2026 or reported as a suspected loss. | CL-11, CL-18 |
Where the register stood at 30 Sep 2026. 17 information assets, each with an owner; 16 classified: 2 Public, 7 Internal and 7 Confidential.
What the quarter showed. The levels were not everything Confidential: 7 of 16 classified assets. The one mistake in the first ratings was aggregation: the price lists were rated as one customer sees them, until the handling check found every customer's prices together in one export (CL-13). The one incident came from Confidential information leaving without its label or its channel (CL-08, CL-09). And the one disposal gap was found only because the certificate was checked serial by serial (CL-11).
The position for the leadership team: 16 of 17 information assets are classified, 7 of them Confidential; the customer price export was found open to all staff and is now Confidential; one customer order spreadsheet went to the wrong business customer (INC-2026-016); and the laptop disposal certificate accounts for 23 of 24 laptops, with the last to be accounted for by 6 Oct 2026 or reported as a loss.
Guidance — delete before approval
IA-17, freight rates and quotes on the rate comparison site, was found in September and is handled as Internal until its owner decides (CL-04). IA-09's review fell due 15 working days after its move into a new system, and was missed: a material change starts its own clock, separate from the 12-month review.
The quarter's legal hold keeps the evidence behind the crime report and the cyber insurer's notice made for the incident (P09 RD-16, RD-15); nothing under it was disposed of. The risk acceptance behind the laptop transition is RA-01 in the risk register.
Adapting this template
Small organisation
Guidance — delete before approval
Keep the three levels, the default and all 20 statements; they cost little when there are few assets. The managing director may own most information, and the IT provider be the custodian of all of it. Start the register with ten assets: customer data, prices, payroll, HR, supplier bank details and board papers matter most.
Where the email system has no sensitivity labels, a subject-line tag and a document footer are enough. Keep the external-recipient check for Confidential information: it prevents the commonest incident.
Regulated entity (NIS2, DORA, GDPR)
Guidance — delete before approval
NIS2 Article 21(2)(i) asks for asset management among the cybersecurity risk-management measures. For the digital providers its Article 1 names, Implementing Regulation (EU) 2024/2690 sets the detail in its Annex, point 12: classification levels for all assets based on confidentiality, integrity, authenticity and availability, periodic review, a handling policy for the whole life cycle communicated to everyone who handles assets, and an inventory. Read authenticity into integrity in the decision method, and align the availability ratings with your continuity and recovery objectives (point 12.1.2(c)).
A DORA financial entity classifies its information assets under Article 8(1) and sets its data and system security procedure on that classification (Delegated Regulation (EU) 2024/1774, Article 11(2)(a)). Name this policy and the handling matrix as that classification and those access restrictions, and set the review interval of both to 12 months.
Under the GDPR, personal data is kept no longer than its purpose needs (Article 5(1)(e)) and protected by measures appropriate to the risk (Article 32). The Personal data marker and CL-07 keep these duties visible; they do not replace the record of processing activities or a data protection impact assessment.
IT and services run by suppliers
Guidance — delete before approval
Your managed IT provider and cloud providers are custodians of most of your information. The information owner still decides the level, and the supplier applies the handling under its contract (CL-16). Put the labels, the certificate window and the deletion confirmation into the contract, using the clauses of the Supplier Contract Security Clause Library.
Delete this section before approval.
Framework references
These references show where this document supports an external framework. They indicate relevance only and do not reproduce the text of any standard. ISO/IEC 27001 references name the clause or control this document relates to. They do not say that meeting it meets any other framework's requirement. Editions referenced: ISO/IEC 27001:2022 incl. Amd 1:2024; NIST CSF 2.0; Directive (EU) 2022/2555 (NIS2) and Implementing Regulation (EU) 2024/2690; Regulation (EU) 2016/679 (GDPR); Regulation (EU) 2022/2554 (DORA) and Delegated Regulation (EU) 2024/1774.
Framework | Reference | Supported by |
|---|---|---|
ISO/IEC 27001:2022 | Annex A 5.12 — Classification of information | Classification levels; Decision method; CL-01 to CL-05, CL-13, CL-14 |
ISO/IEC 27001:2022 | Annex A 5.13 — Labelling of information | Labels on every medium (CL-09); markers |
ISO/IEC 27001:2022 | Annex A 5.10 — Acceptable use of information and other associated assets | Handling at each level; CL-06, CL-08, CL-19 |
ISO/IEC 27001:2022 | Annex A 5.14 — Information transfer | Sharing outside the organisation and transfer (CL-08) |
ISO/IEC 27001:2022 | Annex A 5.33 — Protection of records | Retention and legal holds (CL-11, CL-15) |
ISO/IEC 27001:2022 | Annex A 5.34 — Privacy and protection of PII | The Personal data and Special category markers (CL-07, CL-14) |
ISO/IEC 27001:2022 | Annex A 8.10 — Information deletion | Disposal and deletion (CL-11) |
NIST CSF 2.0 | PR.DS-01 — “The confidentiality, integrity, and availability of data-at-rest are protected” | Handling at each level: data at rest protected by its level (CL-06) |
NIST CSF 2.0 | ID.AM-05 — “Assets are prioritized based on classification, criticality, resources, and impact on the mission” | Decision method: assets prioritised by their classification and impact |
NIST CSF 2.0 | GV.RR-02 — “Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced” | Roles and responsibilities |
NIS2 — Directive (EU) 2022/2555 | Article 21(2)(i) — “human resources security, access control policies and asset management” | Whole policy; regulated-entity tailoring |
NIS2 — Implementing Regulation (EU) 2024/2690 | Article 1 — lays down the technical and methodological requirements of the Article 21(2) measures, and further specifies when an incident is significant, for DNS service providers, TLD name registries, cloud computing, data centre and content delivery network providers, managed service and managed security service providers, providers of online marketplaces, online search engines and social networking services platforms, and trust service providers | Regulated-entity tailoring: the entities the Implementing Regulation binds |
NIS2 — Implementing Regulation (EU) 2024/2690 | Annex, point 12.1.1 — “For the purpose of Article 21(2), point (i) of Directive (EU) 2022/2555, the relevant entities shall lay down classification levels of all assets, including information, in scope of their network and information systems for the level of protection required.” | Classification levels |
NIS2 — Implementing Regulation (EU) 2024/2690 | Annex, point 12.1.2 — the relevant entities shall “(a) lay down a system of classification levels for assets; (b) associate all assets with a classification level, based on confidentiality, integrity, authenticity and availability requirements, to indicate the protection required according to their sensitivity, criticality, risk and business value; (c) align the availability requirements of the assets with the delivery and recovery objectives set out in their business continuity and disaster recovery plans.” | Decision method: levels from confidentiality, integrity and availability; regulated-entity tailoring |
NIS2 — Implementing Regulation (EU) 2024/2690 | Annex, point 12.1.3 — “The relevant entities shall conduct periodic reviews of the classification levels of assets and update them, where appropriate.” | Periodic review of the levels (CL-12) |
NIS2 — Implementing Regulation (EU) 2024/2690 | Annex, point 12.2.1 — “The relevant entities shall establish, implement and apply a policy for the proper handling of assets, including information, in accordance with their network and information security policy, and shall communicate the policy on proper handling of assets to anyone who uses or handles assets.” | Handling at each level; publication to everyone who handles information |
NIS2 — Implementing Regulation (EU) 2024/2690 | Annex, point 12.2.2 — the policy shall “(a) cover the entire life cycle of the assets, including acquisition, use, storage, transportation and disposal; (b) provide rules on the safe use, safe storage, safe transport, and the irretrievable deletion and destruction of the assets; (c) provide that the transfer shall take place in a secure manner, in accordance with the type of asset to be transferred.” | Handling across the life cycle, from storage to disposal (CL-06, CL-11) |
DORA — Regulation (EU) 2022/2554 | Article 8(1) — identify, classify and document ICT-supported business functions, information assets and ICT assets, reviewed at least yearly | Classification levels; regulated-entity tailoring |
DORA — Regulation (EU) 2022/2554 | Article 9(2) — financial entities design, procure and implement ICT security policies, procedures, protocols and tools that aim “to maintain high standards of availability, authenticity, integrity and confidentiality of data, whether at rest, in use or in transit” | Handling at each level: confidentiality, integrity and availability of data at rest, in use and in transit |
DORA — Regulation (EU) 2022/2554 | Article 9(4)(a) — a documented information security policy with rules to protect the availability, authenticity, integrity and confidentiality of data and assets | The policy itself, as part of the information security policy set |
DORA — Delegated Regulation (EU) 2024/1774 | Article 11(2)(a) — the data and system security procedure contains, in accordance with the classification established under Article 8(1) of Regulation (EU) 2022/2554, “the access restrictions referred to in Article 21 of this Regulation, supporting the protection requirements for each level of classification” | Access restricted by level (CL-17); regulated-entity tailoring |
GDPR — Regulation (EU) 2016/679 | Article 5(1)(e) — personal data shall be “kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed” (‘storage limitation’), with the exceptions the Article sets for archiving, research and statistics | Retention no longer than the purpose needs (CL-11) |
GDPR — Regulation (EU) 2016/679 | Article 5(1)(f) — personal data shall be “processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’)” | The Personal data marker; CL-07 |
GDPR — Regulation (EU) 2016/679 | Article 9(1) — “Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation shall be prohibited.”, unless one of the conditions of Article 9(2) applies | The Special category marker; CL-14 |
GDPR — Regulation (EU) 2016/679 | Article 32(1) — appropriate technical and organisational measures to ensure a level of security appropriate to the risk, taking into account the likelihood and severity of risk to people's rights and freedoms | Handling at each level: measures appropriate to the risk |
GDPR — Regulation (EU) 2016/679 | Article 32(2) — in assessing the appropriate level of security, account is taken of the risks presented by processing | Decision method: the harm from disclosure, change or loss judged first |
GDPR — Regulation (EU) 2016/679 | Article 32(4) — “The controller and processor shall take steps to ensure that any natural person acting under the authority of the controller or the processor who has access to personal data does not process them except on instructions from the controller, unless he or she is required to do so by Union or Member State law.” | Users act only on the owner's instructions; Roles and responsibilities |