5.12 Classification of information
Information is to be classified according to the organization's security needs, judged on confidentiality, integrity, availability and the requirements of relevant interested parties. Purpose: make the protection needs of information known and understood in proportion to its importance. Guidance: set a topic-specific classification policy and share it with all relevant interested parties. The scheme accounts for confidentiality, integrity and availability, business needs to share or restrict, legal requirements, and may extend to other assets according to the information they hold or process. Information owners are accountable for classifying their information. The scheme sets classification conventions and criteria for reviewing classifications over time, and classifications are updated as value, sensitivity and criticality change across the life cycle. It should align with the access control policy, meet specific business needs, may base levels on the impact of compromise, and should give each level a meaningful name. It must be applied consistently across the organization and built into procedures so everyone classifies the same way. Because other organizations' schemes differ even with similar level names, and information may be treated differently in each context, information-sharing agreements should include how to identify and interpret the other party's classifications, matching levels by equivalent handling and protection. Other information: classification gives handlers a quick signal of how to protect information and avoids assessing risk and designing controls item by item; sensitivity can lapse (published information still needs integrity and availability protection); over-classifying adds cost and under-classifying leaves information exposed; a four-level confidentiality example runs from no harm, through minor reputational or operational impact and significant short-term impact, to serious long-term impact or a threat to survival.
Source: ISO/IEC 27002:2022, 5.12. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open ISO/IEC 27002:2022 in the compliance library.
ISO/IEC 27002 is guidance on the Annex A controls; certification is against ISO/IEC 27001. Use this set when your sheet follows the 27002 numbering.
These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Classification records in the asset inventory or labels showing owner-assigned classifications · Data governance / DLP tooling
- Records of classification reviews and reclassification when sensitivity or criticality changed · Data governance / DLP tooling
governing documentDocuments that govern the control
- The topic-specific classification policy with named levels, criteria based on impact, and conventions covering confidentiality, integrity and availability · Policy repository / GRC workspace
- Evidence the scheme was communicated to relevant interested parties and built into procedures · Policy repository / GRC workspace
- Information-sharing agreements that map the other party's classification levels to the organization's own · Vendor register / contract repository
- Alignment between the classification scheme and the access control policy · Policy repository / GRC workspace
First move
Common gaps auditors find
- Everything is classified as confidential, so the scheme gives no useful handling signal
- Classifications are never revisited once information is published or ages
- Integrity and availability are ignored and only confidentiality is classified
- Information received from partners is handled under their labels with no agreed mapping
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet