ISO 27002:2022, Control 5.12 – Classification of Information

Ownership of Control 5.12

While there should be an organisation-wide classification of information schemes with classification levels and criteria for how to classify information assets, information asset owners are ultimately responsible for the implementation of a classification scheme.

5.12 explicitly recognizes that owners of the relevant information asset should be accountable.

For example, if the accounting department has access to the folders with payroll reports and bank statements, they should classify information based on the organisation-wide classification scheme.

When classifying information, the asset owner should take into account the business needs, level of impact the compromise of information would have on the organisation and the level of importance and sensitivity of information.

General Guidance on Control 5.12

To implement a robust classification of information scheme, organisations should adopt a topic-specific approach, understand each business unit’s needs for information, and determine the level of sensitivity and criticality of information.

5.12 requires organisations to take into account the the following seven criteria when implementing a classification scheme:

• Establish a topic-specific policy and address the specific business needs

5.12 explicitly refers to 5.1, Access control and requires organisations to adhere to topic-specific policies as described in the 5.1. In addition, the classification scheme and levels should take specific business needs into account.

• Take into account business needs for sharing and use of information and the need for availability

If you assign an information asset to a classification category that is unnecessarily higher, this may bring the risk of disruption to your critical business functions by restricting access to and use of information.

Therefore, you should strive to find a balance between your specific business needs for availability and use of information and the requirements for confidentiality and integrity of that information.

• Consider legal obligations

Some laws may impose stricter obligations on you to ensure confidentiality, integrity and availability of information. When assigning information assets to categories, legal obligations should take priority over your own classification.

• Take a risk-based approach and consider the potential impact of a compromise

Each type of information has a different level of criticality to each business’s operations and has a different level of sensitivity depending on the context.

In implementing classification of information scheme, organisations should ask:

What impact would the compromise of integrity, availability and confidentiality of this information have on the organisation?

For instance, databases of professional email addresses of qualified leads and health records of employees widely differ in terms of the level of sensitivity and the potential impact.

• Regularly review and update the classification

5.12 notes that the value, criticality and sensitivity of information is not static and can change throughout the lifecycle of the information. Therefore, you need to regularly review each classification and make necessary updates.

As an example of such change, the 5.12 refers to the disclosure of information to the public, which greatly reduces the value and sensitivity of information.

• Consult with other organisations you share information with and address any differences

There is no one way to classify information and each organisation can have different names, levels and criteria when it comes to classification of information schemes.

These differences may lead to risks when the two organisations exchange information assets with each other. Therefore, you need to put in place an agreement with your counterpart to ensure that there is consistency in classification of information and interpretation of classification levels.

• Organisational-level consistency

Each department within the organisation should have a common understanding of classification levels and procedures so that classifications are consistent across the entire organisation.

Guidance on How to Implement Classification of Information Scheme

While 5.12 recognises that there is no one-size-fits-all classification scheme and organisations have leeway in deciding and describing individual classification levels, it gives the following example as a information classification scheme:

a) Disclosure causes no harm;

b) Disclosure causes minor reputational damage or minor operational impact;

c) Disclosure has a significant short-term impact on operations or business objectives;

d) Disclosure has a serious impact on long term business objectives or puts the survival of the organisation at risk.

Changes and Differences From ISO 27002:2013

The Classification of Information was addressed in section 8.2.1 in the previous version.

While the two version are highly similar, there is two key differences:

In the old version, there was no explicit reference to the requirement for consistency of classification levels when information is transferred between organisations.

In the 2022 version, however, you need to put in place an agreement with your counterpart to ensure that there is consistency in classification of information and interpretation of classification levels.

Secondly, the new version explicitly requires organisations to put in place topic-specific policies. In the older version, in contrast, there was only a brief reference to the access control.

How ISMS.online Helps

Our platform is intuitive and easy-to-use. It’s not just for highly technical people; it’s for everyone in your organisation. We encourage you to involve staff at all levels of your business in the process of building your ISMS, because that helps you to build a truly sustainable system.

Get in touch today to book a demo.