What is ISO 27001 Information Classification?

Please note new versions of ISO 27001 and ISO 27002 have now been published.

To learn more about what these updates mean for your organisation, and to buy your copies of ISO 27001:2022 and ISO 27002:2022, please visit our information pages.

---

Information classification is a process in which organisations assess the data that they hold and the level of protection it should be given.

Organisations usually classify information in terms of confidentiality – i.e. who is granted access to view it. A typical system contains four levels of confidentiality:

• Confidential (only senior management have access)
• Restricted (most employees have access)
• Internal (all employees have access)
• Public information (everyone has access)

As you might expect, larger and more complex organisations will need more levels, with each one accounting for specific groups of employees who need access to certain information.

The levels shouldn’t be based on employees’ seniority but on the information that’s necessary to perform certain job functions.

Take the healthcare sector for example. Doctors and nurses need access to patients’ personal data, including their medical histories, which is highly sensitive.

However, they shouldn’t have access to other types of sensitive information, such as financial records.

In these cases, a separate classification should be created to distinguish between sensitive medical information and sensitive administrative information.

---

Where does ISO 27001 fit in?

Organisations that are serious about data protection should follow ISO 27001.

The Standard describes best practices for creating and maintaining an ISMS (information security management system), and the classification of information plays a crucial role.

Control objective A.8.2 is titled ‘Information Classification’, and instructs that organisations “ensure that information receives an appropriate level of protection”.

ISO 27001 doesn’t explain how you should do that, but the process is straightforward. You just need to follow four simple steps.

1) Enter your assets into an inventory

The first step is to collate all your information into an inventory (or asset register).

You should also note who is responsible for it (who owns it) and what format it’s in (electronic documents, databases, paper documents, storage media, etc.).

2) Classification

Next, you need to classify the information.

Asset owners are responsible for this, but it’s a good idea for senior management to provide guidelines based on the results of the organisation’s ISO 27001 risk assessment.

Information that would be affected by more significant risks should usually be given a higher level of confidentiality. But be careful, because this isn’t always the case.

There will be instances where sensitive information must be made available to a broader set of employees for them to do their job. The information may well pose a threat if it’s confidentiality is compromised, but the organisation must make it widely available in order to function.

3) Labelling

Once you’ve classified your information, the asset owner must create a system for labelling it.

You’ll need different processes for information that’s stored digitally and physically, but it should be consistent and clear.

For example, you might decide that paper documents will be labelled on the cover page, the top-right corner of each subsequent page and the folder containing the document.

For digital files, you might list the classification in a column on your databases, on the front page of the document and the header of each subsequent page.

4) Handling

Finally, you must establish rules for how to protect each information asset based on its classification and format.

For example, you might say that internal paper documents can be kept in an unlocked cabinet that all employees can access.

By contrast, restricted information should be placed in a locked cabinet, and confidential information stored in a secure location.

Additional rules should be established for data in transit – whether it’s being posted, emailed or employees carry it with them.

You can keep track of all these rules by using a table like this:

Use a table to simplify the data handling documentation process.

---

Become an ISO 27001 expert

You can learn more about information classification and how to implement ISO 27001 with our Certified ISO 27001 ISMS Lead Implementer Training Course.

Designed and delivered by experts, this fully-accredited course equips you with the skills to lead and manage an ISO 27001-compliant ISMS implementation project.

You’ll discover:

• The nine key steps involved in planning, implementing and maintaining an ISO 27001-compliant ISMS;
• Information security management best practices to ensure the confidentiality, integrity and availability of data;
• How to structure and manage your ISO 27001 project; and
• Typical pitfalls and challenges and how to deal with them.

This is one of many training courses that we’re delivering remotely during the ongoing coronavirus crisis, and now may be the perfect time to enrol.

After all, it’s an ideal way to remain productive, and you can study from the comfort of your own home and without jeopardising your health.

---

A version of this blog was originally published on 26 February 2019.