Get in touch

Get in touch

  • This field is for validation purposes and should be left unchanged.

Privacy Notice


When you submit an enquiry via our website, we use the personal data you supply to respond to your query, including providing you with any requested information about our products and services. We may also email you several times after your enquiry in order to follow up on your interest and ensure that we have answered your it to your satisfaction. We will do this based on our legitimate interest in providing accurate information prior to a sale. Your enquiry is stored and processed as an email which is hosted by Microsoft within the European Economic Area (EEA). We keep enquiry emails for two years, after which they are securely archived and kept for seven years, when we delete them.

Reveal Menu

ISO27001 & Information Classification – Common Questions

One of the areas we are asked most questions about is that of the information classification requirements of the ISO/IEC 27001 standard. To be specific, this is covered in a group of three reference controls within Annex A, section A 8.2 which cover classification, labelling and handling of the information within the scope of your Information Security Management System (ISMS).

The questions we are most commonly asked are the following:

  1. What classifications should we use?
  2. How should we go about labelling our information?
  3. What kind of handling procedures do we need?

Let’s take each of these in turn and try to shed some light on the subject.

Information classification image - top secret files illustrated

1. What classifications should we use?

The ISO/IEC 27001 standard doesn’t say much about information classification (although the ISO/IEC 27002 guidance publication has some useful tips) so the details of how you implement the control are pretty much left up to you. The first decision to make is how many levels of classification to have. It’s tempting to over-complicate this in order to reflect the various nuances of your information, but our advice would be to resist this temptation and stick to the lowest number you can reasonably get away with. The trend amongst governments is in this direction, with the UK having recently reduced its classification levels from five to three (Official, Secret and Top Secret), so you’ll be in good company. This doesn’t include information that isn’t classified at all, often referred to as “Public” and which doesn’t need to be protected or labelled.

Choice of names for your classification levels are also up to you. Some of the most common choices are (listed from highest to lowest):

  • Top secret
  • Secret
  • Confidential
  • Restricted
  • Protected
  • Internal Use Only

Names chosen should be appropriate to your organization and a clear definition given of what they mean in practical terms.

2. How should we go about labelling our information?

Having decided what you’re going to call your classification levels, how do you make it clear to everyone involved which information carries which level? Often organizations feel slightly overwhelmed with the thought that they have to suddenly label every single electronic and paper document they have, whilst working out what to do with data held in computer systems too.

The key here is to define an approach that addresses the important stuff first and puts a stake in the ground so that labelling starts from a specified point. Look to label the really confidential, high-value information first as this is likely to be a much smaller volume than the day-to-day less sensitive information. This requires you to have an accurate asset inventory (control 8.1.1 Inventory of assets) so that you know what you’re dealing with. An approach that begins to label all new assets from a certain date will make you feel you are starting to get some control over the issue, whilst considering how to address the historical items. Information assets should have owners and they are the ones who should be looking at labelling so it’s not all down to a single person or department to achieve it; spread the load as much as possible.

Grouping items with the same classification level will also help to make things clear without a huge administrative overhead. Maybe everything held in a particular room is confidential and locking the door and labelling it as such will be enough to meet the need. You may need to invest in a stamp for existing paper copies that need to be individually labelled, but obviously items that are printed in the future should be electronically labelled using headers, footers, watermarks etc.

There are software tools available to help you with this task. These can use metadata to reflect classification level and then prevent certain types of documents being used in particular ways according to a defined policy e.g. confidential documents should not be emailed outside the organization. Some examples of these tools are Boldon James, Titus and Digital Guardian. The Microsoft 365 environment also offers some useful tools if you invest in the right subscription.

For data held in computer systems and databases etc. you will need to consider how to label it whilst it’s in place and also if it needs to go anywhere e.g. printed or extracted onto removable media. Warning messages at logon and procedural controls are probably your best approaches here.

3. What kind of handling procedures do we need?

Having classified and labelled our assets, we also need to make sure that they remain appropriately protected throughout their lives, particularly if they go beyond the organization’s boundaries e.g. to another location via courier or to a third party via electronic transfer. This is really about understanding the ways in which your information assets are used and ensuring that procedures are in place to keep them secure. Again, starting with the highest level assets is usually a good idea. This is an area in which there have been many notorious public breaches to do with government departments with sensitive information such as names, addresses and tax information going missing, sometimes in unencrypted form.

So think about whether your information is saved onto other media, printed, transmitted, emailed or otherwise processed in a way that makes a procedure necessary.

Final thoughts

Of all of the ISO/IEC 27001 reference controls, the ones to do with classification can be the hardest to put in place. What’s needed is a clear approach that uses common sense to protect the most important assets first, whilst recognizing that it’s going to be quite a long journey which will probably never end. But be in no doubt that this should be a fundamental building block of your information security strategy, underpinning many other controls such as access management, physical security and cryptography so it’s worth spending the time to get it right.

Editor’s note: The original post was published in August 2017, and updates have been made in February 2022 for accuracy and comprehensiveness.

Do you need help with your ISMS?

We have a team of ISO27001 experts here at CertiKit who are ready to help you meet the requirements of the standard however you need assistance.

From guidance via our award-winning toolkit, through to consultancy, and internal auditing, we have the tools and personnel available to streamline your ISMS implementation and prepare you for certification fast.

Download your free ISO27001 guide today

Download our free ISO27001: 10 steps to certification guide to learn:

  1. Each step of the process from project planning to the certification audit
  2. Expert tips from the CertiKit team on best practise for easy implementation
  3. Key insights into building a successful ISMS

Download free 10 step guide

We’ve helped more than 4000 businesses with their compliance


Easy to follow, complete, logical setup and approach, and the templates are very easy to customize with company branding.

ReMark International

View all Testimonials