Information Classification and Protection
Classification levels, labelling, media handling and personal data protection
1. Information Classification Scheme
The organisation applies a 4-level classification scheme for information, based on the potential impact of disclosure on the organisation and third parties:
| Level | Label | Description | Examples | Default protection |
|---|---|---|---|---|
| 1 | PUBLIC | Information intended for public release or posing no risk if disclosed | Website, brochures, press releases | Basic (integrity) |
| 2 | INTERNAL | Information for internal use; limited disclosure does not cause serious harm | Internal procedures, organigrams, working reports, internal emails | Access control, no encryption required |
| 3 | CONFIDENTIAL | Sensitive information – unauthorised disclosure may harm the organisation or individuals | Customer data, personal data, commercial contracts, passwords, API keys, audit results | Encryption required, MFA, access logging |
| 4 | SECRET | Critical information – disclosure could cause serious or irreversible harm | Cryptographic keys, critical account passwords, contingency plans, trade secrets, GDPR special category data | Encryption required, strong access control, physical media protection |
2. Classification Responsibilities
- Information creator is responsible for assigning the initial classification at the time of creating or receiving information.
- System owner is responsible for classifying data sets processed in the system.
- Classification must be reviewed at every significant change in content or context of use of the document.
- Default classification for new documents (no label): ▸ [INTERNAL]not lower than Internal.
3. Labelling and Marking
▸ Organisation completes – labelling method
| Medium/format | Labelling method | Label location |
|---|---|---|
| Electronic documents (Office, PDF) | ▸ [header/footer / metadata / watermark] | ▸ [footer of each page / document title] |
| ▸ [subject / message header / automatic labelling] | ▸ [beginning of subject: e.g. [CONFIDENTIAL]] | |
| Physical media (USB drives, printouts) | ▸ [physical label / envelope description] | ▸ [visible location on media] |
| Folders and network shares | ▸ [folder name / README file with classification] | ▸ |
4. Handling Rules by Level
| Rule | PUBLIC | INTERNAL | CONFIDENTIAL | SECRET |
|---|---|---|---|---|
| External sharing | Permitted | Requires approval | Requires NDA + Board approval | Not permitted without Board decision |
| Encryption in transit | Recommended | Recommended | Required (TLS) | Required (end-to-end) |
| Encryption at rest | Not required | Recommended | Required | Required (AES-256+) |
| Printing | Permitted | Permitted | Requires supervision, shredder | Prohibited or with CISO approval, 4-pass shredder |
| Retention | ▸ [e.g. 5 years] | ▸ [e.g. 5 years] | ▸ [e.g. 10 years]per legal requirements | ▸ [e.g. 10 years or indefinitely]per legal requirements |
| Destruction (electronic) | Standard deletion | Standard deletion | Secure deletion (shred / wipe) | Cryptographic erasure + physical destruction of media |
5. Personal Data – GDPR
⚠️
Personal data is at minimum CONFIDENTIAL level. Special category data (GDPR Art. 9: health, biometric, political, religious data) – SECRET.
| Type of personal data | Minimum classification | Special requirements |
|---|---|---|
| Ordinary data (name, email, address) | CONFIDENTIAL | GDPR compliance, retention per processing purposes |
| Special category data (Art. 9) | SECRET | End-to-end encryption, access only for those who need to know |
| Authentication data (passwords, codes) | SECRET | Only as hash (bcrypt/Argon2) – never plain text |
Personal data retention: ▸ [per Record of Processing Activities (RoPA) with DPO]per GDPR and processing purposes.
6. Physical Media Handling
- Media containing CONFIDENTIAL and SECRET data must be encrypted (→ DOC-009).
- Media intended for disposal or transfer must be permanently wiped (NIST 800-88 or physically destroyed).
- Transport of SECRET media off premises: requires ▸ [written CISO approval].
- Lost or stolen media: immediate report to CISO → incident procedure (DOC-005).
7. Change History
| Version | Date | Author | Description | Approved by |
|---|---|---|---|---|
| ▸ 1.0 | ▸ DD/MM/YYYY | ▸ | ▸ Initial release | ▸ Board |
DOC-010 Information Classification and Protection | v1.0 | NIS2/ISMS