System Guides

A.5.13 Labelling of Information would include:

1. Labelling Policy: A documented policy that outlines the organization's approach to labelling information based on its classification level.

2. Labelling Standards: Clear standards and guidelines for creating and applying labels to different types of information assets, specifying the format, content, and placement of labels.

3. Labelling Procedures: Detailed procedures that explain how to create, apply, and remove labels from various information assets.

4. Examples of Labels: Examples of labels that indicate the classification level of information (e.g., Public, Confidential, Secret) along with any other relevant labels, such as handling instructions or access restrictions.

5. Employee Training Records: Documentation demonstrating that employees and relevant stakeholders have received training on how to properly apply labels to information assets.

6. Automated Labelling Tools: Information about any automated tools or software used to assist in applying labels to documents, emails, files, and other information assets.

7. Review and Approval: Records of how labels are reviewed and approved by appropriate authorities within the organization to ensure consistency and accuracy.

8. Access Controls and Labelling: Documentation showing how labelling is integrated with access controls to ensure that only authorized personnel can access information based on its classification.

9. Monitoring and Enforcement: Evidence of mechanisms in place to monitor the correct application of labels and enforce appropriate handling and protection measures.

10. Auditing and Accountability: Records of audits or checks conducted to verify that labels are correctly applied and that access controls and handling procedures align with the labelled classification.

11. Management Oversight: Evidence of management oversight and approval of labelling policies, procedures, and any changes made to labelling standards.

By reviewing these pieces of evidence, an auditor can determine whether the organization has established effective practices for labelling information according to its classification level. This helps maintain consistency, facilitate proper handling, and enable appropriate access controls based on the sensitivity of the information.

A.5.12 Classification of Information would include:

1. Information Classification Policy: A documented policy that outlines the organization's approach to classifying information based on its sensitivity and criticality.

2. Classification Criteria: Clear criteria for determining the classification level of different types of information, including definitions for each classification level (e.g., Public, Confidential, Secret, Top Secret).

3. Classification Labels: Examples of classification labels that are applied to different types of information assets, such as documents, emails, databases, and files.

4. Training Records: Records indicating that employees and relevant stakeholders have received training on the information classification policy, including how to determine the appropriate classification for different types of information.

5. Classification Guidelines: Detailed guidelines or procedures that provide examples and scenarios to assist employees in correctly classifying information.

6. Document Templates: Examples of document templates that include standardized classification labels, headers, or footers indicating the classification level of the content.

7. Access Controls: Documentation showing how access controls are implemented based on the classification level of information, ensuring that only authorized personnel have access to sensitive data.

8. Data Handling Procedures: Procedures that outline how information of different classifications should be handled, transmitted, stored, and destroyed to maintain its confidentiality and integrity.

9. Risk Assessments: Documentation of risk assessments performed to determine the potential impact of unauthorized disclosure, alteration, or loss of information based on its classification.

10. Monitoring and Review: Evidence that information classification is regularly reviewed and updated to reflect changes in the organization's information landscape and evolving risks.

11. Auditing and Accountability: Records of audits or checks conducted to verify that information is correctly classified and that access controls are appropriately enforced.

12. Management Oversight: Evidence of management oversight and approval of information classification policies, procedures, and changes.

By examining these pieces of evidence, an auditor can assess whether the organization has implemented a structured approach to classifying information based on its sensitivity and value. This ensures that information is appropriately protected, shared, and managed according to its level of importance to the organization.