Skip to main content
All measures

Measure · ISO 27001 and other standards

Classify and label information

Decide which protection class applies to the information you use and how it remains identifiable. Connect the label to suitable access and sharing rules.

Accountable: Information ownerReviewed

Reuse existing records

Maintain classification, labelling and handling in Protecting information or the existing policy responsible for those rules. Use existing document templates or configured labels and record discrepancies in the usual task system.

What to do

  1. 1

    Apply the existing classes

    Select typical information from a work process and classify it using your criteria. Resolve incorrect or missing classifications with the responsible person and update the existing rule where needed.

  2. 2

    Define labelling and handling

    Specify the label, permitted recipients, storage locations and transfer channels for each class. Decide whether public material, for example, can remain unlabelled. Apply the rule to existing templates or labels and configure the required access rights separately.

  3. 3

    Check a normal sharing operation

    Use a typical file to check classification, labelling and access after export or sharing. Fix missing labels or incorrect permissions in the application and explain the rule to the relevant team.

Worked example

Confidential quotation example

A salesperson sends a quotation as a PDF to the agreed recipients.

Confidential quotation
DecisionThe template retains the marking in the PDF, which is sent through the approved channel to the intended recipients.
EvidenceExisting template and a check of a typical sharing operation.

Record the result

  • Current policy covering classes, labelling and handling.
  • A suitable example file or a recorded correction to a template or access rights.

Common implementation mistakes

The label does not restrict access

Check permissions and, where needed, encryption in the application being used.

The marking is missing from the export

Check the actual sharing or export channel.

Reuse the implementation across requirements

The references below show which requirements the measure contributes to.

View controls and standards
  • A.5.12 · Klassifizierung von InformationenGerman guide

    Clear criteria and an accountable person support justified information classification.

  • A.5.13 · Kennzeichnung von InformationenGerman guide

    Labelling rules and a checked sharing operation make the classification visible in daily work.

  • A.5.14 · InformationsübertragungGerman guide

    Defined recipients and transfer channels determine permitted information sharing.

  • TISAX · 1.3.2

    VDA ISA 6.0.3 · Partial overlap

    The matrix, markings and handling checks support this assessment topic. The scope and further safeguards still need operation-specific evaluation.

    Reference

  • GDPR · Art. 5(1)(c), 5(1)(f), 32

    EU 2016/679 · Supporting contribution

    For personal information, the checks support minimisation and protection. A label determines neither lawful basis nor overall adequacy of safeguards.

    Reference

Resources for your next step

Sources and further reading