Labelling of information
Purpose
Make the classification of information clear and support automated information handling.
How to meet this control
In short: Develop and implement procedures to label information per the classification scheme.
- Step 01Build labelling into document templates, email classification add-ins (for example Microsoft Purview sensitivity labels) and file metadata
- Step 02Define where labels appear (headers, footers, watermarks, email subject tags, metadata) and where labelling can be omitted
- Step 03Use metadata-driven labels so downstream tooling such as DLP and access controls can act on them automatically
- Step 04Train staff on how and when to apply labels and reinforce through templates and defaults
- Step 05Weigh the risk that visible labels can help attackers and apply labelling proportionately for the most sensitive data
Tip: Use document templates and email footers/labels that map to your classes.
What ISO 27002 says to cover
Reference points from the ISO/IEC 27002:2022 guidance for this control. Use them to check the steps above cover everything relevant to you.
- ›Develop labelling procedures that reflect the organisation's classification scheme
- ›Cover information and associated assets in all formats, physical and electronic
- ›Make labels easily recognisable and give guidance on how and where they are applied
- ›Define cases where labelling can be omitted or where it is not technically possible
- ›Use techniques such as physical labels, headers and footers, metadata, watermarks and stamps
- ›Use metadata for digital information to enable identification, searching and automated decisions
- ›Train personnel so information is labelled and handled correctly
- ›Be aware that labels can help attackers identify valuable data, and weigh that risk
Audit evidence to keep
- - Document and email templates incorporating classification labels
- - Configured sensitivity labels in the productivity suite or DLP platform
- - Staff guidance or training material on labelling procedures
- - Examples of labelled physical and electronic information
Common mistakes
- - Writing a policy but not operating the process
- - Keeping evidence in personal folders where auditors cannot trace it
- - Letting exceptions stay open with no owner or expiry date
Owner, cadence, and proof
Assign one accountable owner for A.5.13. Review this control at least annually, after related incidents, and whenever the underlying process, supplier, system, office, or legal obligation changes. The control is audit-ready when the owner can show the policy or procedure, the latest operating evidence, the latest review, and any open exceptions with due dates.
Policy templates for this control
Use these starting documents to turn the control into evidence. Adapt each template to your scope, systems, legal obligations and actual operating process.