What is ISO 27001 Information Classification?

Information classification is a process in which organisations assess the data that they hold and the level of protection it should be given.

Organisations usually classify information in terms of confidentiality – i.e. who is granted access to see it. A typical system will include four levels of confidentiality:

  • Confidential (only senior management have access)
  • Restricted (most employees have access)
  • Internal (all employees have access)
  • Public information (everyone has access)

As you might expect, larger and more complex organisations will need more levels.

Take hospitals, for example: doctors and nurses need access to patients’ personal data, including their medical histories, which is highly sensitive.

However, they shouldn’t have access to other types of sensitive information, such as financial records.

In cases such as this, a separate level must be created that accounts for specific job functions.

Where does ISO 27001 fit in?

Organisations that are serious about data protection should be following the guidelines set out in ISO 27001.

The Standard describes best practices for creating and maintaining an ISMS (information security management system), and the classification of information plays an important role.

Control objective A8.2 is titled ‘Information Classification’, and instructs that organisations “ensure that information receives an appropriate level of protection”.

The Standard doesn’t explain how you should do that, but the process is relatively simple. You just need to follow four simple steps.

1) Enter your assets into an inventory

The first step is to collate all your information into an inventory (or asset register).

You should also note who is responsible for it (who owns it) and what format it’s in (electronic documents, databases, paper documents, storage media, etc.).

2) Classification

Next, you need to classify the information.

Asset owners are responsible for this, but it’s a good idea for senior management to provide guidelines based on the results of the organisation’s ISO 27001 risk assessment.

Information that would be affected by more significant risks should generally be given a higher level of confidentiality.

Be careful, though, because this isn’t always the case. Our earlier example showed that there will be instances where sensitive information must be made available to a broader set of people for them to do their job.

Organisations that work with the public and private sectors will usually benefit from two separate classification schemes.

This helps them differentiate between information that can and can’t be shared with third parties.

3) Labelling

Once you’ve classified your information, the asset owner must create a system for labelling it.

You’ll need different processes for information that’s stored digitally and physically, but it should be as consistent and clear as possible.

For example, you might decide that paper documents will be labelled on the cover page, the top-right corner of each subsequent page and the folder containing the document.

For digital files, you’ll list the classification in a column on your databases, on the front page of the document and the header of each subsequent page.

4) Handling

Finally, you must establish rules for how to protect each information asset based on its classification and format.

For example, you might say that internal paper documents can be kept in an unlocked cabinet that all employees can access.

By contrast, restricted information should be placed in a locked cabinet and confidential information stored in a secure location.

Additional rules should be established for data in transit – whether it’s being posted, emailed or employees carry it with them.

You can keep track of all these rules by using a table like this:

Information classification table example

Use a table to simplify the data handling documentation process.

Become an ISO 27001 expert

You can learn more about what it takes to adopt the Standard with our Certified ISO 27001 ISMS Lead Implementer Training Course.

Designed and delivered by experts, this fully-accredited course equips you with the skills to lead and manage an ISO 27001-compliant ISMS implementation project.

You’ll discover:

  • The nine key steps involved in planning, implementing and maintaining an ISO 27001-compliant ISMS;
  • Information security management best practices to ensure the confidentiality, integrity and availability of data;
  • How to structure and manage your ISO 27001 project; and
  • Typical pitfalls and challenges and how to deal with them.

This is one of many training courses that we’re delivering remotely during the ongoing coronavirus crisis, and now may be the perfect time to enrol.

After all, it’s an ideal way to remain productive, and you can study from the comfort of your own home and without jeopardising your health.

Find out more


Subscribe to our Weekly Round-up


  1. Milan 6th March 2019
    • Luke Irwin 6th March 2019