{"id":4544,"date":"2014-05-12T21:29:14","date_gmt":"2014-05-12T21:29:14","guid":{"rendered":"https:\/\/multiacademstg.wpengine.com\/27001academy\/blog\/014\/05\/12\/information-classification-according-to-iso-27001\/"},"modified":"2025-11-12T21:11:28","modified_gmt":"2025-11-12T21:11:28","slug":"information-classification-according-to-iso-27001","status":"publish","type":"post","link":"https:\/\/staging.advisera.com\/27001academy\/blog\/2014\/05\/12\/information-classification-according-to-iso-27001\/","title":{"rendered":"How to classify information according to ISO 27001 in four steps"},"content":{"rendered":"

Updated:\u00a0November 14, 2022., according to ISO 27001:2022 revision.<\/em><\/p>\n

Classification of information is certainly one of the most attractive parts of information security management, but at the same time, one of the most misunderstood. This is probably due to the fact that historically, information classification was the first element of information security that was being managed \u2014 long before the first computer was built, governments, military, and even corporations labeled their information as confidential. However, the process of how it worked remained somewhat of a mystery.<\/p>\n

So, in this article I\u2019ll give you an outline of how information classification works, and how to make it compliant with ISO 27001<\/a>, the leading information security standard. Although classification can be done according to other criteria, I\u2019m going to speak about classification in terms of confidentiality, because this is the most common way to specify information classification levels.<\/p>\n

\n
The four-step process for classifying information according to ISO 27001:<\/div>\n
\n
    \n
  1. Entering the asset in the Inventory of Assets<\/a><\/li>\n
  2. Classification of information<\/li>\n
  3. Information labelling<\/li>\n
  4. Information handling<\/li>\n<\/ol>\n<\/div>\n<\/div>\n

    The four-step process for classifying<\/strong> information<\/h2>\n

    Good practice for classifying information says that classification should be done via the following process:<\/p>\n

    \"Information<\/p>\n

     <\/p>\n

    This means that: (1) the information should be entered in the Inventory of Assets (control A.5.9 of ISO 27001), (2) it should be classified (A.5.12), (3) it should be labeled (A.5.13), and finally, (4) it should be handled in a secure way (A.5.10).<\/p>\n

    In most cases, companies will develop an Information Classification Policy<\/a>, which\u00a0should describe all these four steps for classifying information \u2014 see the text below for each of these steps.<\/p>\n

    Please note that this process applies to both data (the raw recorded material that has no specific meaning) and information (the meaning you give to, and insights you get from data). In a classification context, generally data and information are treated the same.<\/p>\n

    <\/div>