A.5.12ISO 27001Last reviewed 19 February 2026

ISO 27001 A.5.12: Classification of information

Not all information deserves the same level of protection. A public blog post and a customer database are fundamentally different things, and your security controls should reflect that. Classification gives you a structured way to decide what protection each piece of information needs.

Work through the ISO 27001 assessment, record supporting evidence and review the gaps in your answers.

Start my free ISO 27001 assessmentNo account · No credit card · Save when useful

Requirement summary

Information shall be classified in terms of legal requirements, value, criticality and sensitivity to unauthorised disclosure or modification.

Check the source wording and scope in ISO/IEC 27001:2022. The guidance below explains how to approach a review.

In Plain Language

A typical scheme uses three or four levels - something like Public, Internal, Confidential, and Restricted. Each level comes with defined handling requirements covering how the information is created, stored, transmitted, and disposed of. The classification should factor in legal requirements (personal data, for instance), contractual obligations, business impact of disclosure, and the information's value.

The information owner or creator assigns the initial classification. Over time it may change as sensitivity or value evolves. Everyone who handles information needs to understand the scheme and how to apply it correctly - a classification system that nobody uses is worse than not having one at all.

How to Implement

Design a classification scheme that is simple enough for everyone to use. Three to four levels works for most organisations. A common approach: Public (intended for external sharing), Internal (general business information), Confidential (disclosure would harm the organisation), and Restricted (needs the strictest protection).

For each level, define clear criteria so information owners can make the right call. Address legal and regulatory sensitivity, financial impact of disclosure, reputational damage, contractual obligations, and operational impact. Include concrete examples for each level - people learn better from examples than abstract definitions.

Spell out handling requirements for each level across the full lifecycle: creation and labelling, storage (encryption needs, physical security), transmission (encryption in transit, approved channels), sharing (who can access, what approvals are needed), copying restrictions, and disposal (secure deletion or destruction).

Train everyone on the scheme, how to apply it, and what the handling requirements mean in practice. Quick reference guides and decision trees help people make the right classification call without having to re-read the full policy every time.

Back it up with technology where you can. DLP tools can detect and protect classified information. Information rights management can enforce access controls on classified documents. Automated classification tools can help with consistency at scale. Review the scheme regularly as business needs and regulations evolve.

Evidence to review

Documented information classification scheme with defined levels and criteria
Classification handling requirements for each level across the information lifecycle
Evidence of classification training and awareness for personnel
Samples of classified information showing correct labeling and handling
Records of classification reviews and updates

Common Mistakes

Classification scheme is too complex with too many levels, leading to inconsistent application
Information owners do not understand their responsibility to classify information
Classification labels are not applied to documents, emails, and data stores
Handling requirements for each level are not defined or not followed in practice
No process for reclassification when information sensitivity changes over time

Related Controls Across Frameworks

Framework	Control ID	Relationship
SOC 2	SOC 2 CC6.1: Logical and Physical Access - Security Software, Infrastructure, and Architectures	Partial overlap
GDPR	GDPR Art.9	Partial overlap
GDPR	GDPR Art.32: Security of Processing	Related
NIS2	NIS2 Art.21(2)(a): Policies on Risk Analysis and Information System Security	Partial overlap

Frequently Asked Questions

How many classification levels should we have?

Three to four is the sweet spot for most organisations. More than that and people get confused, leading to inconsistent application. A typical scheme uses Public, Internal, Confidential, and Restricted. The test is simple: if two levels would have identical handling requirements, merge them. Every level needs to mean something different in practice.

Who is responsible for classifying information?

The information owner or creator handles the initial classification. Business unit leaders typically set the classification policy for their domain, and individuals creating information apply it. When in doubt, classify higher until someone with the right context can review it. Automated tools can help with consistency at scale, but you still need human judgement for context.

Track ISO 27001 compliance in one place

Work through the ISO 27001 assessment, record supporting evidence and review the gaps in your answers.

Start Free Assessment

Start without an account · Sign up only to save

Start my free ISO 27001 assessment