ISO 27001 Control A.5.12: Classification of Information

Not all information deserves the same protection. A public price list, a staff lunch rota, a customer contract and a database of health records sit at very different points on the scale of harm if they leak, change or disappear. If you treat everything as top secret, people stop taking the label seriously and the cost of protection becomes unbearable. If you treat everything as ordinary, the sensitive material is exposed. Classification is how you sort the difference. A.5.12 is the twelfth of 37 organizational controls in Annex A.

A good classification scheme is simple enough to remember and clear enough to apply without a meeting. It gives your teams a shared vocabulary: this is internal, this is confidential, this needs special care. And it lets you spend your protection effort where it counts.

What the control requires

Annex A control 5.12 of ISO 27001:2022 states that information shall be classified according to the information security needs of the organization based on confidentiality, integrity, availability and relevant interested party requirements.

The key elements:

Classified - each piece or type of information is placed into a defined category
Information security needs of the organization - the classification reflects what matters to your business, not an abstract template
Confidentiality, integrity, availability - the three properties of the CIA triad, which we explain in our post on the CIA triad in ISO 27001
Relevant interested party requirements - customers, regulators and partners may impose their own demands, such as contractual or legal expectations

A.5.12 is a preventive control in ISO/IEC 27002:2022. It prevents under-protection and over-protection by tying controls to the value and sensitivity of what is protected. Annex A states the control; ISO 27002 gives guidance, including that classification results should reflect the value, sensitivity and criticality of information, be updated according to changes, and be consistent across the organization. Importantly, classification is not only about secrecy: information whose accuracy or availability is critical, such as a pricing engine or a patient schedule, can need a high classification even if it is not confidential.

How to implement classification of information

Design a small scheme

Most organizations do best with three or four levels. A typical example is:

Public - intended for anyone, such as marketing material and published articles
Internal - for staff and trusted partners, where disclosure would be embarrassing or inconvenient but not harmful
Confidential - customer data, contracts, financial information and anything whose disclosure could cause real damage
Restricted - the small set of material needing the strictest handling, such as security credentials or highly sensitive personal data

You may use different names, and you may combine levels if two would be treated the same way. The test of a good level is whether it leads to a different handling rule. If two categories require identical treatment, merge them. Many frameworks and customers use their own labels, so a mapping to the schemes your key clients use can save confusion.

Avoid designing the scheme in isolation. Involve the people who produce and use information, because they know how it flows and what would hurt.

Define the criteria

For each level, write down criteria in business terms. Think about the consequences of loss of confidentiality (who would be harmed, how badly), loss of integrity (what decisions or processes would be corrupted) and loss of availability (how long could we manage without it). Add legal or contractual triggers, such as personal data, regulated information or material under a confidentiality obligation. You do not need elaborate scoring; a short table of examples is more useful than a long formula. Our confidentiality or non-disclosure agreements post explains one source of interested-party requirements you will have to honour.

Where laws about personal data or other regulated categories apply, treat the legal text as a source of requirements to be confirmed with qualified advisers, not something the scheme can decide for you.

Assign classification to owners

Responsibility for classification should rest with the owner of the information, which is why the inventory of information and other associated assets records owners. Owners classify the information types they are accountable for, using the criteria. This works at the level of categories, such as “customer contracts” or “payroll data”, rather than document by document. Individual documents inherit from the category unless the author knows better.

Record the classification in the inventory, so that systems, repositories and datasets carry a level. This is also where you apply consistent handling, such as access limits, encryption, retention and sharing rules, tied to each level. These rules should be the same ones described in acceptable use of information and other associated assets, which gives people a way to follow the classification without consulting a manual.

Link classification to controls

A scheme only matters if it changes something. For each level, define the minimum handling requirements. For example:

Who may access it, and how that access is approved
Whether it may be stored on personal devices or in external services
How it must be transmitted
Whether it needs encryption at rest or in transit
How it is printed, copied, shared and disposed of, with links to clear desk and clear screen and storage media
How long it is kept

Keep the matrix short: levels across the top, handling topics down the side. People can print it and stick it to a wall.

Review and keep consistent

Information changes sensitivity over time. A forthcoming announcement is confidential until published, and then public. A project plan can become routine once the project ends. Build in periodic review of classifications, and make sure that when information is shared with partners you agree how their scheme maps to yours. The scheme itself deserves review through your regular ISMS cycle, as part of keeping documents controlled under clause 7.5.3, Control of documented information.

Teach it

Introduce the scheme in induction and refresh it in information security awareness, education and training. Use real examples from your own organization. People learn classification best when they see “this is a customer list, so it is confidential” rather than reading abstract definitions.

A.5.1 connection. Policies for information security usually states the classification principle and points to the scheme.

A.5.9 connection. Inventory of information and other associated assets is where classifications and owners are recorded.

A.5.10 connection. Acceptable use of information and other associated assets turns each classification into handling rules.

A.6.6 connection. Confidentiality or non-disclosure agreements protect information your partners and staff receive.

A.7.10 connection. Storage media handling often depends on the classification of what is stored.

Clause 4.2 connection. Understanding the needs and expectations of interested parties is where customer and regulatory requirements that shape classification come from.

Forward reference. Labelling of information, information transfer and access control, covered next in the series, depend directly on the classification you choose here.

What auditors check

A documented scheme. Auditors ask for the classification policy or procedure and check that levels are defined with criteria and handling rules.

Basis in needs. They look for evidence that the scheme considers confidentiality, integrity, availability and interested party requirements, not only secrecy.

Application in practice. They sample information assets and systems to see whether they have been classified and whether the classification is recorded in the inventory.

Staff understanding. Interviews test whether people can explain the levels and give examples from their own work.

Handling follows level. Auditors check that controls such as access, encryption and sharing differ between levels as the scheme says.

Review. Evidence that classifications and the scheme are reviewed shows the control is maintained.

Common mistakes to avoid

Too many levels. Seven categories with subtle differences will not be remembered, and people will guess.

Only about secrecy. Information that must stay accurate or available needs protection too, whether or not it is confidential.

Classifying document by document. It does not scale. Classify categories and systems, and let documents inherit.

No consequences. If a level changes nothing about how information is handled, it is a label without a purpose.

IT decides alone. Business owners understand the value and impact of their information better than the technical team.

Never reviewing. Old classifications linger long after the sensitivity has changed, either wasting effort or leaving gaps.

How 27kay can help

We help organizations design classification schemes that are small enough to use and strong enough to guide real decisions, then link them to handling rules, the inventory and training. As part of ISO 27001 implementation, we run short workshops with your information owners so that the scheme reflects how your business actually works. For the full picture, see our ISO 27001 knowledge hub.

If a new colleague found a spreadsheet of customer details on a shared drive, would they know how carefully to treat it? Get in touch - we will help you make that obvious to everyone.