5.13 Labelling of information
Procedures for labelling information are to be developed and put into effect in line with the classification scheme the organization has adopted. Purpose: make classifications visible to people and systems and support automated processing and management of information. Guidance: labelling procedures cover information and associated assets in every format, reflect the scheme from 5.12 and use labels that are easy to recognize. They explain where and how labels go, depending on the way people reach the information or handle the media, and can set when labelling is skipped (for example non-confidential material, to save effort), how to label information held or sent electronically, physically or otherwise, and what to do where labelling is technically impossible. Techniques include physical labels, headers and footers, metadata, watermarks and stamps. Digital information should carry metadata that supports identification, management and control, particularly for confidentiality, enables accurate searching, and lets systems act on the labels; procedures describe how metadata is attached, which labels apply and how data is handled, consistent with the information model and ICT architecture, and systems add further metadata as they process information. Staff and other interested parties are made aware of the procedures and trained to label and handle correctly. System output containing sensitive or critical information carries the right label. Other information: labels are central to information sharing; recording the creating process and time is useful; labels can also help attackers spot valuable assets; some systems protect everything at the highest level they may contain and label only on export.
Source: ISO/IEC 27002:2022, 5.13. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open ISO/IEC 27002:2022 in the compliance library.
ISO/IEC 27002 is guidance on the Annex A controls; certification is against ISO/IEC 27001. Use this set when your sheet follows the 27002 numbering.
These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.
system holds itEvidence a system already holds
- Configuration of labelling or data classification tooling that applies metadata and enforces handling decisions · Cloud console / configuration management
periodic reviewEvidence produced at each review
- Evidence that sensitive system outputs such as reports and exports carry classification labels · Data governance / DLP tooling
- Training records for personnel on labelling and handling · HR system / LMS
governing documentDocuments that govern the control
- Labelling procedures covering all formats, with rules on placement, exemptions and cases where labelling is not possible · Policy repository / GRC workspace
- Examples of labelled documents, emails, reports and media showing the chosen techniques such as headers, watermarks or metadata · Policy repository / GRC workspace
- Documented handling for systems that protect at the highest level and label on export · Policy repository / GRC workspace
First move
Common gaps auditors find
- Labels exist on documents but not in metadata, so DLP and other systems cannot act on them
- Reports and data exports from business systems carry no label
- Labelling rules for physical media and paper are missing
- Users are never trained, so labels are applied inconsistently or not at all
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet5.12 Classification of information · 5.14 Information transfer