ISO 27001 Annex A 5.12 Information classification policy and practices
What it says
Information shall be classified according to the information security needs of the organization based on confidentiality, integrity, availability and relevant interested party requirements.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishClassify data based on security needs so everyone handles it correctly.
Classifying information means deciding how sensitive or critical it is, which helps everyone handle it properly. If we don't classify our information correctly, it might get shared inappropriately, lost, or altered, leading to security breaches or legal issues.
Free. Save your status, tasks and notes.
Why it matters
Without information classification, sensitive data can be mishandled or disclosed, leading to breaches, legal non-compliance and reputational damage.
How to implement
The IT manager should develop a clear policy on information classification.
This involves creating categories like 'confidential', 'internal use', and 'public', and outlining how to handle each one. Use the ISO 27002 guidance as a framework to ensure it covers confidentiality, integrity, and availability.
Human Resources should train all employees on the new classification policy.
They should explain why classifying information is important and provide examples of proper handling for each classification category. This training ensures everyone knows their role in protecting the company's data.
Department heads should work together to identify the types of information within their area that need classification.
They should map out what data they handle, determine its sensitivity, and classify it according to the policy. Regularly update this classification as business needs change or new information comes in.
The legal team should review the classification policy to ensure it aligns with applicable Australian laws, such as the Privacy Act 1988.
They should check that there's a clear process for legal and regulatory compliance, especially for confidential information.
The IT department should implement technical controls that align with the classification policy.
For example, restricting access to confidential information to authorised personnel only and applying encryption where necessary. Ensure these controls are tested and effective in keeping sensitive information secure.
Keep it running
Periodically review classification labels and handling rules against CIA needs and interested party requirements as data sensitivity and policies change.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
A copy of the information classification policy.
Look at
Its completeness and clarity in defining different information categories and handling procedures.
Good evidence
Policy clearly describes each classification, handling requirements, and aligns with ISO 27002 guidance.
- Check 2 of 5What an auditor asks for
Look at
Whether all relevant employees received training and the understanding level reflected in feedback. Effective training records should show comprehensive coverage of topics and positive feedback from participants.
- Check 3 of 5What an auditor asks for
Ask for
To see the department-specific classification documents.
Look at
Consistency in how information is classified across departments and updates reflecting current operations. Good practice shows regularly reviewed documents aligned with policy standards.
- Check 4 of 5What an auditor asks for
Ask for
Legal compliance documentation related to data classifications.
Look at
How the legal team ensures alignment with Australian laws, such as the Privacy Act 1988. Good compliance documentation should indicate regular reviews and updates as laws change.
- Check 5 of 5What an auditor asks for
Look at
Whether they restrict access according to classification levels and if there are any incidents of breach. Good evidence shows strict access controls and minimal to no breaches.
Mappings
Closest match in ASD Information Security Manual: ISM-0201, Labelling requirements for TOP SECRET conduits, which this control covers in full and more.
ASD Information Security Manual: 28 mappings
This control is broader than ISM-0201.
ISM-0201 mandates a specific handling safeguard for TOP SECRET environments by requiring conduits to be clearly identified as TOP SECRET runs. Annex A 5.12 establishes the broader requirement to classify information according to confidentiality, integrity and availability needs, which is what drives the existence of a TOP SECRET category and associated handling rules. ISM-0201 is therefore a concrete, classification-driven control that sits underneath the classification policy and practices required by Annex A 5.12.
This control is broader than ISM-0270.
Annex A 5.12 requires information to be classified based on confidentiality, integrity and availability needs and related requirements. ISM-0270 operationalises classification for a specific channel by requiring emails to carry protective markings reflecting the highest sensitivity/classification of the subject, body and attachments. ISM-0270 is narrower (email marking practice), while Annex A 5.12 covers the enterprise-wide classification scheme and handling expectations across all media and systems.
This control is broader than ISM-0293.
Annex A 5.12 requires organisations to classify information based on security needs so people and systems handle it correctly. ISM-0293 applies that concept to IT equipment by classifying equipment according to the highest sensitivity/classification of data it is approved to process, store or communicate. ISM-0293 is a specific application to assets/equipment, while Annex A 5.12 covers the overall information classification policy and practices across the organisation.
This control is broader than ISM-0323.
ISM-0323 requires media to be classified to the highest sensitivity or classification of any data it stores. ISO/IEC 27001:2022 Annex A 5.12 establishes the requirement for an organisation-wide information classification policy. ISM-0323 is a specific rule within that broader scheme, focusing on classifying storage media when multiple data sensitivities exist.
This control is broader than ISM-0325.
ISM-0325 requires that any media connected to a higher-classified/sensitivity system be reclassified up to that higher level (unless read-only access is assured). Annex A 5.12 establishes the organisation's overall information classification policy and practices that define classification levels and decision criteria. ISM-0325 operationalises one specific classification rule (inheritance/upgrade on connection) rather than defining the broader classification scheme.
This control is broader than ISM-0332.
Annex A 5.12 requires information to be classified according to organisational security needs (confidentiality, integrity, availability) and interested party requirements, so it is handled appropriately. ISM-0332 implements part of this by requiring media to be labelled with protective markings that reflect its sensitivity/classification. ISM-0332 focuses on physical/media labelling, whereas Annex A 5.12 is broader and includes defining the classification scheme and applying it across information in all forms.
This control is broader than ISM-0358.
ISM-0358 mandates a specific classification outcome: sanitised EPROM/EEPROM that previously held SECRET or TOP SECRET information must continue to be treated at that classification. Annex A 5.12 establishes the organisation's overall classification policy and practices used to determine and apply classification based on security needs and requirements. Annex A 5.12 supports ISM-0358 by providing the governance mechanism to define and institutionalise this explicit exception to typical downgrading/declassification expectations, but it does not itself prescribe the EPROM/EEPROM retention rule.
This control is broader than ISM-0393.
Annex A 5.12 requires information to be classified according to the organisation's confidentiality, integrity and availability needs and relevant interested party requirements. ISM-0393 is a specific application of that requirement to databases, mandating that databases and their contents take a classification based on the sensitivity of the data they contain. Annex A 5.12 is broader because it covers all information types and the overarching policy/practices, not just database assets.
This control is broader than ISM-1083.
Annex A 5.12 requires information to be classified so handling and communication align with its security needs and stakeholder requirements. ISM-1083 applies this to mobility by requiring personnel to be advised what sensitivity/classification is permitted for voice and data communications when using mobile devices. ISM-1083 is a narrow awareness/usage control for mobile communications, whereas Annex A 5.12 is broader and establishes the classification basis and organisation-wide practices.
This control is broader than ISM-1089.
ISM-1089 requires enforcement to stop downgrading of protective markings on email replies and forwards. ISO/IEC 27001:2022 Annex A 5.12 requires the organisation to classify information according to business and security needs, which drives what markings should be used and when. ISM-1089 implements a concrete safeguard to uphold that classification policy in email workflows, but Annex A 5.12 covers the wider governance of classification decisions beyond email tooling.
This control is broader than ISM-1729.
ISM-1729 mandates specific classification outcomes for TOP SECRET destruction residues based on measurable particle sizes. This is an application of Annex A 5.12, which requires information to be classified according to business/security needs and interested party requirements. ISM-1729 provides a concrete classification rule for a particular scenario, while Annex A 5.12 is broader policy/practice covering all information assets and classification decisions.
This control partially overlaps ISM-0027.
ISM-0027 requires authorisation to operate for each system handling non-classified, OFFICIAL: Sensitive, PROTECTED or SECRET information, based on accepted security risk. Annex A 5.12 involves classification, which is pivotal in identifying systems requiring ISM-0027 compliance, hence forming a complementary basis for scoping under ISM-0027.
This control supports ISM-0269.
ISM-0269 requires enforcing handling rules for specific sensitive classifications by preventing sending to distribution lists unless recipient nationalities are confirmed. Annex A 5.12 establishes how information is classified and what classification practices apply, which is a prerequisite to knowing which emails fall into AEO/AGAO/Releasable To categories. Without Annex A 5.12-style classification rules and labelling/handling practices, implementing ISM-0269 consistently is difficult because the organisation cannot reliably identify in-scope content.
This control supports ISM-0271.
ISM-0271 requires that protective marking tools do not automatically insert protective markings into emails, preventing unintended or incorrect classification being applied without user intent. Annex A 5.12 establishes the broader organisational requirement to classify information according to business and security needs, which is typically operationalised through user-selected classifications in tools like email clients. ISM-0271 supports Annex A 5.12 by enforcing that classification is a deliberate act aligned to the classification policy, rather than an automated, potentially inaccurate tool behaviour.
This control supports ISM-0272.
Annex A 5.12 requires organisations to implement information classification policy and practices so information is consistently classified and handled. ISM-0272 supports this by technically constraining protective marking tools so users cannot apply markings that exceed what the system is authorised to process, store or communicate, reducing misclassification and inappropriate handling. ISM-0272 is about enforcing correct marking selection in tooling, while Annex A 5.12 is the overarching requirement to define and apply classification.
This control supports ISM-0565.
ISM-0565 requires email servers to block, log and report emails with inappropriate protective markings. ISO/IEC 27001:2022 Annex A 5.12 establishes the organisation's information classification policy and practices that define what markings exist and how they must be applied. ISM-0565 depends on Annex A 5.12-style classification rules being defined so the email server can reliably determine what constitutes an 'inappropriate' protective marking.
This control supports ISM-0831.
ISM-0831 requires media to be handled according to its sensitivity or classification. Annex A 5.12 establishes the classification policy and practices that determine what those sensitivity/classification levels are and how they should be applied. Without a defined classification scheme from Annex A 5.12, implementing ISM-0831 consistently is difficult because the organisation lacks the basis for deciding appropriate handling requirements.
This control supports ISM-0835.
ISM-0835 specifies a concrete classification handling outcome: sanitised TOP SECRET volatile media may still retain TOP SECRET classification when data remanence is plausible due to extended or repeated storage patterns. ISO/IEC 27001:2022 Annex A 5.12 requires an organisation-wide information classification policy and practices, which provides the governance mechanism to define and apply rules like ISM-0835 consistently. Annex A 5.12 is broader and policy-focused, while ISM-0835 is an implementation-specific classification retention rule for a particular scenario.
This control supports ISM-1053.
ISM-1053 requires physical security measures (security zones for server/communications rooms) to be suitable for the classification of the equipment housed within them. Annex A 5.12 requires information to be classified according to confidentiality, integrity and availability needs, which determines what classification (and therefore what physical zone standard) should apply to the equipment and systems. Without the classification practices in Annex A 5.12, organisations cannot reliably determine what 'suitable for their classification' means for ISM-1053.
This control supports ISM-1461.
ISM-1461 requires that when virtualisation is used to share a physical server for SECRET or TOP SECRET computing environments, the host and all guests must be the same classification and within the same security domain. ISO/IEC 27001:2022 Annex A 5.12 is a prerequisite because the organisation must have an information classification policy and practices to determine what is treated as SECRET/TOP SECRET (or equivalent) and therefore what workloads must not be co-hosted across differing classifications/domains. Annex A 5.12 does not impose any virtualisation or co-tenancy restriction itself, but it provides the classification basis needed to apply ISM-1461 consistently.
This control supports ISM-1530.
ISM-1530 requires organisations to select security containers suitable for the classification of the equipment and the security zones in which it resides. ISO/IEC 27001:2022 Annex A 5.12 requires information to be classified according to the organisation's security needs. In practice, implementing ISM-1530 depends on having a classification scheme (Annex A 5.12) so the organisation can determine what container rating and controls are appropriate, but Annex A 5.12 does not itself require physical containerisation.
This control supports ISM-1599.
ISM-1599 mandates handling IT equipment based on sensitivity or classification. ISO/IEC 27001:2022 Annex A 5.12 outlines the organisation's information classification practices, essential for determining sensitivity/classification for equipment handling. Without classification (Annex A 5.12), consistent sensitivity-based handling per ISM-1599 is challenging.
This control depends on ISM-0462.
ISM-0462 requires that organisations treat IT equipment or media according to its original sensitivity/classification during the period a user is authenticated to encryption. Annex A 5.12 requires information to be classified based on confidentiality, integrity and availability needs, which establishes what the 'original sensitivity or classification' actually is. Without a defined classification scheme from Annex A 5.12, ISM-0462 cannot be applied consistently because there is no authoritative baseline classification to retain during encryption-authenticated access.
This control depends on ISM-0501.
ISM-0501 requires transport controls for keyed cryptographic equipment to be selected based on the sensitivity/classification of the keying material. Annex A 5.12 requires an organisation to classify information based on security needs (confidentiality, integrity, availability) and requirements. In practice, ISM-0501 depends on having a classification scheme (per Annex A 5.12) so that the sensitivity of keying material can be determined and the correct transport method applied.
This control depends on ISM-0589.
ISM-0589 requires preventing MFD scanning/copying of documents above the sensitivity/classification of the connected network. Annex A 5.12 establishes the organisation's information classification policy and practices that define what 'above' means and how information is categorised. Without Annex A 5.12 (or an equivalent classification scheme), ISM-0589 cannot be consistently implemented because there is no authoritative basis for sensitivity thresholds and handling rules.
This control depends on ISM-0694.
ISM-0694 enforces an access restriction specifically tied to SECRET and TOP SECRET classifications and to privately-owned devices. Annex A 5.12 is a prerequisite in practice because classification policy and practices define what information is SECRET/TOP SECRET and how it must be handled, enabling ISM-0694 to be applied consistently. Annex A 5.12 is broader while ISM-0694 is one resulting access prohibition for high classifications.
This control depends on ISM-1482.
ISM-1482 requires enforced separation of classified data from personal data on organisation-owned devices, which presumes the organisation can identify what is 'classified' and what is 'personal'. Annex A 5.12 establishes information classification policy and practices, providing the prerequisite labelling/handling rules needed to decide what data must be segregated to meet ISM-1482. Without classification practices, implementing and auditing the separation required by ISM-1482 is materially undermined.
This control depends on ISM-1719.
ISM-1719 requires a concrete classification-driven marking rule: TOP SECRET cables are coloured red to signal their sensitivity. This supports Annex A 5.12 because an effective information classification policy and practice typically needs implementable handling and identification conventions for classified assets, and ISM-1719 is one such convention applied to a specific asset type (cabling). Annex A 5.12 sets the organisational approach to classification across information and associated assets, whereas ISM-1719 does not define classification criteria and only prescribes one physical marking outcome.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.
Get help with this control
ISO 27001 training
Mindset Cyber runs PECB-accredited ISO/IEC 27001 training that maps directly to the controls in this library.
Need this as a written policy?
PolicyMint drafts the ISO 27001 documentation this control expects, customised to your business and checked by three independent verifiers before you see it. Not a boilerplate template you have to fight into shape. First document free.
Draft your ISO 27001 documentation