ISO 27001 Annex A control 5.12 asks for a classification scheme and 5.13 for labelling to match it. A workable scheme has a few levels, such as public, internal, confidential and restricted, with clear handling rules for each; schemes with many levels tend to be ignored.
Classification feeds the asset inventory, access control and the retention rules in a privacy programme. The Annex A guide covers the controls.
Read more
Related terms
- Asset inventory
- An asset inventory is the maintained list of information and of the systems, devices, software and services that hold it, each with an owner and classification.
- Least privilege
- Least privilege is the principle that every user, service and agent gets only the access it needs for its task, and no more.
- Annex A
- Annex A of ISO/IEC 27001:2022 is the reference list of 93 information security controls, grouped into organizational, people, physical and technological themes.
- Control
- A control is a measure an organization puts in place to manage a risk or meet a requirement, such as an access review, an approval step or encryption.