Classification of information

Plain-language summary

Sorting information into a small number of levels according to how much protection it needs — judged on confidentiality, integrity, availability and what clients, regulators and the law require — so people know which rules apply to which information.

What the clause is really asking

Classification lets you protect information in proportion to its value instead of treating everything the same. This control asks you to sort information into levels that reflect what would happen if it were disclosed, altered or unavailable, taking into account what clients, regulators and the law require of you. A topic-specific policy sets out the scheme: the levels, what qualifies for each, who decides, and how classifications are reviewed as information becomes more or less sensitive over time. The information owner is accountable for classifying it. The scheme must be applied the same way across the organisation and tie directly to handling rules, so a Confidential document is treated alike in every department. The common misunderstanding is that more levels mean better security; four is usually plenty and three often works better. Another is classifying on confidentiality alone and ignoring integrity and availability. In South Africa, make personal information, and special personal information under POPIA section 26, explicit triggers in the scheme, and carry each classification into the information asset register.

What auditors look for

Auditors ask for the classification policy and test whether people can apply it. They pick a handful of documents, records and datasets — a payroll file, a customer contract, a price list, a drawing — and ask the owner and a user what level each is and why. They check the information asset register shows classifications and that they match what people say. They look at whether handling rules actually differ between levels, and whether personal information is consistently placed at the right level. The hard question: who decided this classification, and what changes in how it is handled because of it?

Typical evidence

Classification policy defining levels, criteria, owner responsibilities and review; information asset register with a classification per asset; handling rules per classification level; examples of classification decisions; training material on classification; records of reclassification or review; mapping of client or contractual classification schemes to your own.

How to comply — recommendations

Define three or four levels — for example Public, Internal, Confidential and Restricted — with plain criteria and examples for each drawn from your own business. Make personal information at least Confidential and special personal information Restricted. Give classification to the information owner and record it in the information asset register. Publish a one-page handling table for each level and link it to the acceptable use policy. Map client classification schemes to yours where contracts require it. Train staff with real examples from their own work. Review classifications annually and whenever information changes in sensitivity, such as when a product launch makes it public.

Common nonconformities

No classification scheme, or one nobody can explain; too many levels applied inconsistently; information not classified in the asset register; personal information placed at the wrong level; classification based on confidentiality only; no link between levels and handling rules; client classification requirements ignored; classifications never reviewed.

Resources for this clause

• ArticleISO/IEC 27001:2022 Annex A explained: the 93 controls in plain English, theme by theme, with the 114-to-93 map and the attribute tags
• ArticleThe Statement of Applicability, explained — what ISO/IEC 27001 clause 6.1.3 requires, the four ways an SoA fails Stage 1, and how to build one from the risk register
• ArticleISO/IEC 27001:2022 explained for people who already run ISO 9001: what is the same, what is new, and how to get certified
• Toolkit · $39Risk & SoA ToolkitScore your information security risks on a documented method, pick the Annex A controls that treat them, and the Statement of Applicability writes its own first draft — every justification citing the risks behind it.
• Toolkit · $29ISMS Metrics & Evidence TrackerThe three things an ISMS has to show after certification, in one workbook: measures with a live Green / Amber / Red status, management review minutes that cover every required input, and an evidence register that gives every control an owner, a rhythm and a due date.
• Free downloadAnnex A 93 Controls Quick ReferenceOne A3 page: all 93 Annex A controls in their four themes, the eleven new in 2022 flagged, and the ISO/IEC 27002:2022 attribute legend — the poster for the wall beside the Statement of Applicability.
• Free downloadISO 27001 Gap Analysis ChecklistWhere you stand against ISO/IEC 27001:2022 in one afternoon — the 30 management-system requirements and all 93 Annex A controls, scored, with owners, dates and a readiness figure that calculates itself.
• Free masterclass · ~27 minISO 27001 MasterclassYou already know four fifths of ISO 27001. Here is the other fifth — the risk method, the SoA, the 93 controls, the evidence rhythm, POPIA, and a 44-week path.
• Free appAudit ManagerPlan the programme, anchor each finding to its clause and drive the NC to closure.