ISO 27001 A.5.12: Classify Information by Its Protection Needs

What A.5.12 requires in practice

Annex A control A.5.12 asks that information be classified according to the organisation’s security needs. Four factors are named as the basis: confidentiality, integrity, availability and the requirements of relevant interested parties. In other words, classification reflects what would go wrong if the information were disclosed, altered or unavailable, and what customers, regulators or partners expect.

The organisation sets its own scheme: how many levels, what they are called and what criteria separate them. A simple scheme that staff can apply consistently usually works better than a detailed one that nobody remembers. Classification should be applied to information, not only to systems, and handling arrangements should be able to follow from it.

The control does not prescribe particular levels, labels or tools. Its purpose is to let proportionate protection be applied, so that the most sensitive information gets the strongest safeguards and routine material is not burdened unnecessarily.

Assess the consequence that protection needs to address

Ask what could happen if the information were disclosed, changed incorrectly or unavailable when needed. Different consequences can require different controls. A sensitive negotiation file may need restricted disclosure, while an approved production instruction may depend particularly on accurate content and reliable availability.

Consider relevant customer commitments and applicable requirements using competent input. Avoid deriving a classification solely from the department holding the information or the file extension. A spreadsheet can contain an informal estimate, critical operational data or personal information with very different protection needs.

Choose categories that lead to workable handling

A scheme should help people select appropriate storage, access, transfer and other handling arrangements. If two categories lead to exactly the same decisions, consider whether the distinction adds value. If one category contains information with materially different needs, a single generic rule may conceal the difference.

Use clear criteria and familiar examples to support consistent judgement. The organisation may represent confidentiality separately from other criticality information, or use another coherent method. What matters is that integrity and availability are not forgotten because the visible label focuses on secrecy. Connect the decision to labelling and actual protection arrangements.

Give owners a route to resolve uncertainty

Information owners should understand their role in determining and reviewing classification. Users need a practical way to ask for a decision when requirements are unclear or several information sets are combined. Automatic defaults can reduce omission, but they should not prevent an informed review of an unusual case.

For external information, establish what a customer’s or partner’s classification means in practice. Identical labels may carry different handling expectations. Agree the relevant protection rather than assuming that a familiar word means the same thing on both sides of a transfer.

Why classifying information matters to the business

Without classification, organisations tend to protect everything the same way or, more often, protect almost nothing well because priorities are unclear. A sensible scheme helps people decide quickly how to treat a document, a dataset or a message, and helps the business direct limited effort at what matters most.

It also supports commitments to customers. Many contracts and regulations expect different care for different kinds of information. When classification reflects those expectations, handling decisions become defensible and consistent. Assessors read a well-used scheme as a sign that the organisation understands its own information, while an unused one suggests documentation without practice.

How to implement A.5.12

Keep the scheme small and test it on real information before rolling it out. Involve a few information owners early, because their examples make the scheme concrete and win acceptance across the business.

1. Identify the main kinds of information the business holds, such as customer records, financial data, designs and internal communications.
2. Ask what harm would follow if each were exposed, changed or unavailable, and what contracts or laws expect.
3. Choose a small number of levels with plain descriptions and a few familiar examples for each.
4. Decide who classifies new information and who may change a classification, usually the information owner.
5. Link each level to handling expectations, so classification leads to action and is not simply a label.
6. Brief staff using their own examples and check that different people classify the same item the same way.
7. Review the scheme periodically and after significant changes to the business or its obligations.

Evidence an auditor expects for A.5.12

Common nonconformities with A.5.12

Typical weaknesses show a scheme that exists in theory but does not shape decisions. Assessors usually test the scheme by asking ordinary staff to classify a realistic piece of information.

• Staff interviewed cannot say what the levels mean or give an example of each.
• Information is classified, but the handling expectations for each level are missing or ignored.
• Customer requirements for classification are not reflected in the organisation’s own scheme.
• Classification was carried out once and has never been revisited as information changed.
• Owners are not identified for key information, so nobody can decide or change a classification.

Illustrative manufacturing example: an approved process instruction

Illustrative software example: pricing before and after launch

A hypothetical software company prepares a new pricing offer under restricted commercial access. After publication, some content becomes public, while internal negotiating limits and customer-specific assumptions remain sensitive. The owner reviews the information set instead of leaving every related document under the original blanket restriction.

The published pricing still requires protection against unauthorised changes and loss of availability. The team separates public material from internal analysis and updates handling instructions. A change in confidentiality does not mean every security need has disappeared.

Review classification as information changes

Relevant triggers can include publication, aggregation, a changed contractual requirement or a different business use. Combining individually ordinary records may create a more sensitive collection. Conversely, retaining unnecessary restrictions after a legitimate change can slow work and encourage people to bypass the scheme.

Choose review arrangements that suit the information’s lifecycle. Do not invent a universal annual relabelling requirement. Use the inventory and ownership arrangements to find the right decision-maker and keep consequential changes connected with access and transfer controls.

Evidence can include the classification method, owner decisions and examples showing how classification affects handling. A test might give two relevant users the same scenario and compare their reasoning, then inspect the actual protection. Common failures include classifying everything at the highest level, using labels without corresponding rules and assuming public information needs no integrity protection.