Classifying information under ISO 27001 (A.5.12 and A.5.13) with example
Classifying information means sorting it into a few levels of sensitivity, so everyone knows how to handle it. In ISO/IEC 27001:2022 , this is control A.5.12 “Classification of information” in Annex A. A.5.13 “Labelling of information” requires you to make that classification visible on documents and in systems.
A classification scheme works like a translation table. The label “confidential” tells an employee straight away: do not send it to a personal email address, share it encrypted and lock it away when you leave your desk. The classification appears in your asset register and determines which measures from your risk assessment apply where.
Short answer: for ISO 27001 A.5.12, set up a classification scheme with usually three or four levels, based on the damage if information is leaked, changed or lost. For each level, define rules for storing, sharing and destroying. For A.5.13, make sure the level is visible, for example with a label in the header or a sensitivity label in Microsoft 365.
What do A.5.12 and A.5.13 require?
ISO 27002:2022 provides the detailed guidance. A.5.12 requires you to classify information based on confidentiality, integrity and availability requirements, and on what stakeholders and legislation demand. A.5.13 requires a procedure to label information according to that scheme.
| Control | Title (ISO/IEC 27001:2022) | What you produce |
|---|---|---|
| A.5.12 | Classification of information | Classification scheme with levels and rules |
| A.5.13 | Labelling of information | Agreements and tools to make labels visible |
| A.5.14 | Information transfer | Rules for sharing information, linked to the level |
| A.5.10 | Acceptable use of information and other associated assets | Usage rules per level |
The standard does not say how many levels you choose or what they are called. Pick levels your employees can remember. In practice, more than four levels is rarely workable.
Example classification scheme for ISO 27001
This scheme with four levels is written for an organisation of 20 to 200 employees. The “Examples” column is the most important part, because that is where employees recognise their own work.
| Level | When | Examples | Damage if leaked |
|---|---|---|---|
| Public | Intended for everyone | Website, job vacancies, brochure, press release | None |
| Internal | For all employees, not for outsiders | Work instructions, intranet, internal newsletter, organisation chart | Limited, annoying but not harmful |
| Confidential | Only for those who need it | Customer data, quotations, contracts, source code, project files | Noticeable damage for customers or the company |
| Strictly confidential | Small, named group | Personnel files, medical data, salaries, acquisition plans, password vault | Serious damage, possibly a data breach that must be reported |
Unlabelled information falls under “internal” by default. That way, nobody has to label every email, and there is still a safe default.
Rules per classification level
A level without rules has no effect. So link concrete agreements to each level. Employees read this table more often than the policy itself.
| Rule | Public | Internal | Confidential | Strictly confidential |
|---|---|---|---|---|
| Storing | Anywhere | Company environment | Company environment, access by role | Protected folder or system, access by name |
| Sharing within the company | Freely | Freely | Only with those who need it | Only with the owner’s permission |
| Sharing outside the company | Freely | Not without a reason | Via a secure share link or encrypted email | Encrypted only, with the owner’s permission |
| Printing | Freely | Freely | Collect with a badge | Preferably not; otherwise collect immediately and store |
| At the desk | Freely | Freely | Store when you walk away | Always store |
| Destroying | Bin | Bin | Paper bin | Paper bin, digitally secure wipe |
| Label | None | Optional | Mandatory | Mandatory |
The rules for desks and printers align with your clean desk policy. The rules for sharing belong to A.5.14.
How do you label information (A.5.13)?
Labelling does not need to be complicated. Choose a method for each type of information that fits how people work:
- Documents: the level in the header or footer, using a template that already contains the label.
- Microsoft 365 or Google Workspace: sensitivity labels that also enforce technical rules, such as encryption or a block on external sharing.
- Folders and systems: label the folder or system instead of each file. Everything in the “HR files” folder is strictly confidential.
- Email: a label in the subject line or a button in the mail client.
- Physical media: a sticker on the USB drive or the archive file.
For small organisations, labelling at system level is often enough. Record in your asset register which level belongs to which system.
What does the auditor ask for as evidence for A.5.12 and A.5.13?
During an ISO 27001 audit, the auditor checks whether the scheme exists and whether employees use it. Expect the following:
- The approved classification scheme with levels and rules.
- The classification column in the asset register.
- A sample check: the auditor opens a quotation and asks what level it has.
- A conversation with an employee: “How do you send a contract to a customer?”
- Technical settings, such as sensitivity labels or a block on external sharing for certain folders.
A well-designed scheme that employees do not know will lead to a finding. Include the four levels and the rules in your awareness training, and hang the table where people can see it.
Common mistakes in information classification
Too many levels. Six levels with subtle differences are not remembered by anyone. Three or four is enough.
Everything is confidential. If everything gets the highest label, people stop taking labels seriously. Use “strictly confidential” sparingly.
Confidentiality only. A.5.12 also covers integrity and availability. A production schedule may not be secret, but it must be accurate and available.
No default for unlabelled information. Record what applies when there is no label on the information.
Classification and the AVG separate. Personal data usually falls under at least “confidential”. Special category personal data, such as health data, falls under the highest level. See also AVG (GDPR) and ISO 27001.
Information classification in government
Government bodies that follow the BIO2 (Baseline Information Security Government, the Dutch government information security baseline) classify information in all information systems with an explicit risk assessment and an established method for impact classification. That is stricter than ISO 27001, which leaves the method open.
Frequently asked questions about information classification
How many classification levels do you need for ISO 27001?
The standard does not prescribe a number. Three or four levels is common. Choose the number your employees can remember.
Does every document need a label?
No. With a default level for unlabelled information and labels at folder or system level, you cover most cases. Only label individual documents that are more sensitive than their surroundings.
Who decides the classification?
The owner of the information, as recorded in the asset register. Employees who create new documents follow the level of the folder or system.
More information
- Asset register: where you record the classification per item
- Clean desk policy: rules for paper and screens per level
- Remote working and BYOD policy: which information may be on a personal device
- Annex A: all 93 controls, including A.5.9 to A.5.14
- Mandatory documents: the classification scheme in the documentation set
- ISO 27002:2022 : the implementation guidance for A.5.12 and A.5.13