Labelling of information

Plain-language summary

Marking information with its classification — on documents, emails, files, media and systems — following defined procedures, so anyone handling it can see at a glance which rules apply and tools can act on the label automatically.

What the clause is really asking

Classification only works if people can tell which level a piece of information is at. This control asks for labelling procedures that follow your classification scheme, put into practice rather than left on paper. They should cover information in every format — paper, electronic documents, email, removable media, systems and databases — and say how labels are applied: headers and footers, watermarks, email subject tags, metadata, stickers or stamps. They should also say where no label is needed (often public information, sometimes internal) and what to do where a visible label cannot be attached, such as relying on metadata or system-level labels. Staff need to know how to apply labels and what each one tells them to do. The common misunderstanding is that labelling must be manual and universal. Mainstream office suites can apply, suggest or enforce labels, and machine-readable labels let data leakage tools act on them. Another trap is printing 'Confidential' in every template footer, which teaches everyone to ignore the word. Labels should drive handling, not decorate documents.

What auditors look for

Auditors ask for the labelling procedure and check it matches the classification scheme. They then sample documents, emails, shared folders, printed reports and removable media to see whether labels are present and correct. They ask staff what a label means and what they would do differently because of it. Where automated labelling is used, they look at the configuration and policy settings. They check that exemptions are defined and that labels survive when information is exported or printed. The hard question: if I find a Restricted document without a label, what does your procedure say should have happened?

Typical evidence

Labelling procedure linked to the classification policy; document and email templates carrying labels; configuration of sensitivity-label or automated labelling tools; examples of labelled documents, media and reports; defined exemptions; training records on labelling; data leakage prevention rules using labels; spot-check records of labelling compliance.

How to comply — recommendations

Write a one-page labelling procedure stating, for each classification level, how to label paper, documents, email, files, media and systems, and which levels need no label. Build labels into document and email templates. If your office suite supports sensitivity labels, configure them to match your scheme, set a sensible default and make a label mandatory at the highest levels. Use metadata labels where visible marking is impractical. Train staff with examples from their own work. Spot-check a sample of documents and emails each quarter and use what you find in awareness training.

Common nonconformities

No labelling procedure; labels inconsistent with the classification scheme; highly sensitive documents unlabelled; every document labelled Confidential regardless of content; removable media and printed reports unlabelled; labelling tools configured but not used; staff unable to explain what labels mean; no defined exemptions.

Resources for this clause

• ArticleISO/IEC 27001:2022 Annex A explained: the 93 controls in plain English, theme by theme, with the 114-to-93 map and the attribute tags
• ArticleThe Statement of Applicability, explained — what ISO/IEC 27001 clause 6.1.3 requires, the four ways an SoA fails Stage 1, and how to build one from the risk register
• ArticleISO/IEC 27001:2022 explained for people who already run ISO 9001: what is the same, what is new, and how to get certified
• Toolkit · $39Risk & SoA ToolkitScore your information security risks on a documented method, pick the Annex A controls that treat them, and the Statement of Applicability writes its own first draft — every justification citing the risks behind it.
• Toolkit · $29ISMS Metrics & Evidence TrackerThe three things an ISMS has to show after certification, in one workbook: measures with a live Green / Amber / Red status, management review minutes that cover every required input, and an evidence register that gives every control an owner, a rhythm and a due date.
• Free downloadAnnex A 93 Controls Quick ReferenceOne A3 page: all 93 Annex A controls in their four themes, the eleven new in 2022 flagged, and the ISO/IEC 27002:2022 attribute legend — the poster for the wall beside the Statement of Applicability.
• Free downloadISO 27001 Gap Analysis ChecklistWhere you stand against ISO/IEC 27001:2022 in one afternoon — the 30 management-system requirements and all 93 Annex A controls, scored, with owners, dates and a readiness figure that calculates itself.
• Free masterclass · ~27 minISO 27001 MasterclassYou already know four fifths of ISO 27001. Here is the other fifth — the risk method, the SoA, the 93 controls, the evidence rhythm, POPIA, and a 44-week path.
• Free appAudit ManagerPlan the programme, anchor each finding to its clause and drive the NC to closure.