What are the different information classification categories available in TCS

Classification of information is certainly one of the most attractive parts of information security management, but at the same time, one of the most misunderstood. This is probably due to the fact that historically, information classification was the first element of information security that was being managed – long before the first computer was built, governments, military, but also corporations labeled their information as confidential. However, the process on how it worked remained somewhat a mystery.

So, in this article I’ll give you an outline of how information classification works, and how to make it compliant with ISO 27001, the leading information security standard. Although classification can be made according to other criteria, I’m going to speak about classification in terms of confidentiality, because this is the most common type of information classification.

The four-step process for classifying information according to ISO 27001:

1. Entering the asset in the Inventory of Assets
2. Classification of information
3. Information labelling
4. Information handling

The four-step process for classifying information

Good practice for classifying information says that classification should be done via the following process:

This means that: (1) the information should be entered in the Inventory of Assets (control A.5.9 of ISO 27001), (2) it should be classified (A.5.12), (3) then it should be labeled (A.5.13), and finally (4) it should be handled in a secure way (A.5.10).

In most cases, companies will develop an Information Classification Policy, which should describe all these four steps for classifying information – see the text below for each of these steps.

Please note that this process applies to both data (the raw recorded material that has no specific meaning) and information (the meaning you give to, and insights you get from data). In a classification context, generally data and information are treated the same.

Asset inventory (Asset register)

The point of developing an asset inventory is that you know which classified information you have in your possession, and who is responsible for it (i.e., who is the owner).

Classified information can be in different forms and types of media, e.g.:

• electronic documents
• information systems / databases
• paper documents
• storage media (e.g., disks, memory cards, etc.)
• information transmitted verbally
• email

Defining confidentiality levels

Defining confidentiality levels for information classification is important because it helps organizations understand the importance of each type of information for them. The higher the classification, the more important the information is, and then more resources should be considered for its protection.

ISO 27001 does not prescribe the levels of classification (i.e., there is no ISO 27001 information classification nor ISO 27001 data classification schemes) – this is something you should develop on your own, based on what is common in your country or in your industry. The bigger and more complex your organization is, the more levels of confidentiality you will have – for example, for a mid-size organization you may use this kind of information classification levels with three confidential levels and one public level:

• Confidential (top confidentiality level)
• Restricted (medium confidentiality level)
• Internal use (lowest level of confidentiality)
• Public (everyone can see the information)

In most cases, the asset owner is responsible for classifying the information – and this is usually done based on the results of the risk assessment: the higher the value of information (the higher the consequence of breaching the confidentiality), the higher the classification level should be. (See also ISO 27001 Risk Assessment, Treatment, & Management: The Complete Guide.)

Very often, a company may have two different classification schemes in place if it works both with the government and with a private sector. For example, NATO requires the following classification with four confidential levels and two public levels:

• Cosmic Top Secret
• NATO Secret
• NATO Confidential
• NATO Restricted
• NATO Unclassified (copyright)
• NON SENSITIVE INFORMATION RELEASABLE TO THE PUBLIC

However, is important to note that in very specific situations, where information importance is homogeneous, organizations can adopt a single classification level. It is perfectly acceptable by the standard to use single or multiple confidentiality levels as their ISO 27001 information classification/ISO 27001 data classification structure.

Information labeling

Once you classify the information, then you need to label it appropriately – you should develop the guidelines for each type of information asset on how it needs to be classified – again, ISO 27001 is not prescriptive here, so you can develop your own rules.

For example, you could set the rules for paper documents such that the confidentiality level is to be indicated in the top right corner of each document page, and that it is also to be indicated on the front of the cover or envelope carrying such a document, as well as on the filing folder in which the document is stored.

Labeling of information is usually the responsibility of the asset owner.

Handling of assets

This is usually the most complex part of the classification process – you should develop rules on how to protect each type of asset depending on the level of confidentiality. For example, you could use a table in which you must define the rules for each level of confidentiality for each type of media, e.g.:

So in this table, you can define that paper documents classified as Restricted should be locked in a cabinet, documents may be transferred within and outside the organization only in a closed envelope, and if sent outside the organization, the document must be mailed with a return receipt service.

As before, ISO 27001 allows you freedom to set your own rules, and this is usually defined via the Information classification policy, or the Classification procedures.

So, as you can see, the classification process might be complex, but it does not have to be incomprehensible – ISO 27001 actually allows you great freedom, and you should definitely take advantage of it: make the process both adapted to your special needs, but at the same time secure enough so that you can be sure your sensitive information is protected.

If you decide to implement ISO 27001 yourself, ISO 27001 Documentation Toolkit can also help you with the information classification process.

What are the different information classification categories available?

What are the 4 types of classification?

What are the five 5 classification levels of information?

What are the 3 types of information classification?