All 93 controls · Organizational controls
Control 5.12
Classification of information
What ISO/IEC 27002:2022 control 5.12 asks for, in our own words, with the five published attribute values, the evidence an auditor asks for and the gaps commonly found. ISO/IEC 27028 is the guidance that explains how to use these values.
What the control asks
Information is to be classified according to the organization's security needs, judged on confidentiality, integrity, availability and the requirements of relevant interested parties. Purpose: make the protection needs of information known and understood in proportion to its importance. Guidance: set a topic-specific classification policy and share it with all relevant interested parties. The scheme accounts for confidentiality, integrity and availability, business needs to share or restrict, legal requirements, and may extend to other assets according to the information they hold or process. Information owners are accountable for classifying their information. The scheme sets classification conventions and criteria for reviewing classifications over time, and classifications are updated as value, sensitivity and criticality change across the life cycle. It should align with the access control policy, meet specific business needs, may base levels on the impact of compromise, and should give each level a meaningful name. It must be applied consistently across the organization and built into procedures so everyone classifies the same way. Because other organizations' schemes differ even with similar level names, and information may be treated differently in each context, information-sharing agreements should include how to identify and interpret the other party's classifications, matching levels by equivalent handling and protection. Other information: classification gives handlers a quick signal of how to protect information and avoids assessing risk and designing controls item by item; sensitivity can lapse (published information still needs integrity and availability protection); over-classifying adds cost and under-classifying leaves information exposed; a four-level confidentiality example runs from no harm, through minor reputational or operational impact and significant short-term impact, to serious long-term impact or a threat to survival.
Purpose in the standard’s terms, in our words: Ensures the protection needs of information are identified and understood according to its importance.
Attribute values in one line: Preventive; Confidentiality, Integrity, Availability; Identify; Information protection; Protection, Defence.
The five attribute values
These are the published values for this control, from ISO/IEC 27002:2022 clause 4.2 and Annex A Table A.1. Where your own value differs, record the difference and the reason in the same row rather than replacing the published value.
| Control type | Preventive |
|---|---|
| Information security properties | ConfidentialityIntegrityAvailability |
| Cybersecurity concepts | Identify |
| Operational capabilities | Information protection |
| Security domains | ProtectionDefence |
Evidence an auditor asks for
The attribute is a claim about how the control behaves. The evidence is what proves it operates. Keep both, and keep them together.
- The topic-specific classification policy with named levels, criteria based on impact, and conventions covering confidentiality, integrity and availability
- Evidence the scheme was communicated to relevant interested parties and built into procedures
- Classification records in the asset inventory or labels showing owner-assigned classifications
- Records of classification reviews and reclassification when sensitivity or criticality changed
- Information-sharing agreements that map the other party's classification levels to the organization's own
- Alignment between the classification scheme and the access control policy
Where audits commonly find gaps
- Everything is classified as confidential, so the scheme gives no useful handling signal
- Classifications are never revisited once information is published or ages
- Integrity and availability are ignored and only confidentiality is classified
- Information received from partners is handled under their labels with no agreed mapping
What ISO/IEC 27028 changes for this control
It carries a single control type, preventive, which sets what the evidence has to prove. It contributes no detect function, so a control set built from this row alone would not show detection. Its earlier numbering (08.2.1) is kept in the register so an older audit file can still be traced. It serves more than one security domain, which is why a domain count taken by row understates the view.
The guidance expands how the five values are used; it does not change the control or add a requirement. A register that carries the values and the evidence can answer the attribute question for this control without a new document. A register that does not can add the columns at the next SoA version, with an owner and a review date.
Controls that share its values
Source for this page
- ISO/IEC 27002:2022, the control catalogue and Table A.1. The reference record of the 93 controls, their five attribute values, purpose, evidence and gaps. The published standard is at https://www.iso.org/standard/75652.html.
- ISO/IEC 27028, official record. Stage 60.00 under publication, edition 1, committee, abstract and the dated lifecycle. Retrieved 20 October 2026.
Retrieved 2026-10-20. The requirement above is our statement of the clause in our own words; the official text is linked so you can check it.
The attribute kit, USD 799 one off. The 109-row register with all five values, the evidence list, a dated plan and the extension worksheet, as PDF, CSV and XLSX.