ISO 27001 & ISO 22301 Blog

Information classification according to ISO 27001

Updated: November 14, 2022., according to ISO 27001:2022 revision.

Classification of information is certainly one of the most attractive parts of information security management, but at the same time, one of the most misunderstood. This is probably due to the fact that historically, information classification was the first element of information security that was being managed – long before the first computer was built, governments, military, but also corporations labeled their information as confidential. However, the process on how it worked remained somewhat a mystery.

So, in this article I’ll give you an outline of how information classification works, and how to make it compliant with ISO 27001, the leading information security standard. Although classification can be made according to other criteria, I’m going to speak about classification in terms of confidentiality, because this is the most common type of information classification.

The four-step process for classifying information according to ISO 27001:
  1. Entering the asset in the Inventory of Assets
  2. Classification of information
  3. Information labelling
  4. Information handling

The four-step process for classifying information

Good practice for classifying information says that classification should be done via the following process:

Information classification – How to do it according to ISO 27001


This means that: (1) the information should be entered in the Inventory of Assets (control A.5.9 of ISO 27001), (2) it should be classified (A.5.12), (3) then it should be labeled (A.5.13), and finally (4) it should be handled in a secure way (A.5.10).

In most cases, companies will develop an Information Classification Policy, which should describe all these four steps for classifying information – see the text below for each of these steps.

Please note that this process applies to both data (the raw recorded material that has no specific meaning) and information (the meaning you give to, and insights you get from data). In a classification context, generally data and information are treated the same.

Asset inventory (Asset register)

The point of developing an asset inventory is that you know which classified information you have in your possession, and who is responsible for it (i.e., who is the owner).

Classified information can be in different forms and types of media, e.g.:

  • electronic documents
  • information systems / databases
  • paper documents
  • storage media (e.g., disks, memory cards, etc.)
  • information transmitted verbally
  • email

Defining confidentiality levels

Defining confidentiality levels for information classification is important because it helps organizations understand the importance of each type of information for them. The higher the classification, the more important the information is, and then more resources should be considered for its protection.

ISO 27001 does not prescribe the levels of classification (i.e., there is no ISO 27001 information classification nor ISO 27001 data classification schemes) – this is something you should develop on your own, based on what is common in your country or in your industry. The bigger and more complex your organization is, the more levels of confidentiality you will have – for example, for a mid-size organization you may use this kind of information classification levels with three confidential levels and one public level:

  • Confidential (top confidentiality level)
  • Restricted (medium confidentiality level)
  • Internal use (lowest level of confidentiality)
  • Public (everyone can see the information)

In most cases, the asset owner is responsible for classifying the information – and this is usually done based on the results of the risk assessment: the higher the value of information (the higher the consequence of breaching the confidentiality), the higher the classification level should be. (See also ISO 27001 Risk Assessment, Treatment, & Management: The Complete Guide.)

Very often, a company may have two different classification schemes in place if it works both with the government and with a private sector. For example, NATO requires the following classification with four confidential levels and two public levels:

  • Cosmic Top Secret
  • NATO Secret
  • NATO Confidential
  • NATO Restricted
  • NATO Unclassified (copyright)

However, is important to note that in very specific situations, where information importance is homogeneous, organizations can adopt a single classification level. It is perfectly acceptable by the standard to use single or multiple confidentiality levels as their ISO 27001 information classification/ISO 27001 data classification structure.

Information labeling

Once you classify the information, then you need to label it appropriately – you should develop the guidelines for each type of information asset on how it needs to be classified – again, ISO 27001 is not prescriptive here, so you can develop your own rules.

For example, you could set the rules for paper documents such that the confidentiality level is to be indicated in the top right corner of each document page, and that it is also to be indicated on the front of the cover or envelope carrying such a document, as well as on the filing folder in which the document is stored.

Labeling of information is usually the responsibility of the asset owner.

Handling of assets

This is usually the most complex part of the classification process – you should develop rules on how to protect each type of asset depending on the level of confidentiality. For example, you could use a table in which you must define the rules for each level of confidentiality for each type of media, e.g.:

Internal use Restricted Confidential
Electronic documents
Information systems
Paper documents
Storage media
Verbally transmitted information

So in this table, you can define that paper documents classified as Restricted should be locked in a cabinet, documents may be transferred within and outside the organization only in a closed envelope, and if sent outside the organization, the document must be mailed with a return receipt service.

As before, ISO 27001 allows you freedom to set your own rules, and this is usually defined via the Information classification policy, or the Classification procedures.

So, as you can see, the classification process might be complex, but it does not have to be incomprehensible – ISO 27001 actually allows you great freedom, and you should definitely take advantage of it: make the process both adapted to your special needs, but at the same time secure enough so that you can be sure your sensitive information is protected.

If you decide to implement ISO 27001 yourself, ISO 27001 Documentation Toolkit can also help you with the information classification process.

Advisera Dejan Kosutic
Dejan Kosutic
Leading expert on cybersecurity & information security and the author of several books, articles, webinars, and courses. As a premier expert, Dejan founded Advisera to help small and medium businesses obtain the resources they need to become certified against ISO 27001 and other ISO standards. He believes that making ISO standards easy to understand and simple to use creates a competitive advantage for Advisera's clients.

As an ISO 27001 expert, Dejan helps companies find the best way to obtain certification by eliminating overhead and adapting the implementation to their size and industry specifics.
Connect with Dejan: