Key takeaways
- Label information by how sensitive it is so people know how to protect it.
- Not all information needs the same protection.
- Start here: define a simple scheme, usually three or four levels such as Public, Internal, Confidential, Restricted.
Purpose
Label information by how sensitive it is so people know how to protect it.
Requirement
Requirement summaryInformation shall be classified according to the information security needs of the organization based on confidentiality, integrity, availability and relevant interested party requirements.
Why it matters
Not all information needs the same protection. Classification lets you focus effort where the impact of exposure is highest.
How to implement
- Define a simple scheme, usually three or four levels such as Public, Internal, Confidential, Restricted.
- Base levels on confidentiality, integrity, availability and legal needs.
- Assign owners to classify the information they are responsible for.
- Train staff with practical examples of each level.
What evidence you need to provide
Here is what you will typically need to provide for Annex A 5.12. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- Your classification policy: the levels you use (for example Public, Internal, Confidential) and what goes in each.
- Your Statement of Applicability (SoA: the list of all 93 controls showing which you use and why) with A.5.12 marked as used or not used, a short reason, and its current status.
Records and examples to show
- Examples of information with its classification recorded, such as in the asset inventory.
- Proof classifications are reviewed from time to time.
Things you should be able to show or explain
- Staff should be able to explain the levels and give an example of each.
How much to show: Five or so documents or data sets of different types.
Common mistakes
- Scheme exists but nobody uses it.
- Staff can't explain the levels.
- Too many levels, so nobody applies them consistently.
- A scheme that exists on paper but is not used anywhere.
- Tip: Three or four levels (e.g. Public, Internal, Confidential) are enough.
Policies & documents to have
- Data Management Policy
FAQ
Is A.5.12 mandatory?
Annex A controls are not automatically mandatory. You must consider every control and record in your Statement of Applicability whether it applies and why. In practice, most organisations include this one.
What will I need to show for A.5.12?
Be ready to explain how the control works in your organisation and to provide things like: Your classification policy: the levels you use (for example Public, Internal, Confidential) and what goes in each…