Labelling of information

What the control asks

Procedures for labelling information are to be developed and put into effect in line with the classification scheme the organization has adopted. Purpose: make classifications visible to people and systems and support automated processing and management of information. Guidance: labelling procedures cover information and associated assets in every format, reflect the scheme from 5.12 and use labels that are easy to recognize. They explain where and how labels go, depending on the way people reach the information or handle the media, and can set when labelling is skipped (for example non-confidential material, to save effort), how to label information held or sent electronically, physically or otherwise, and what to do where labelling is technically impossible. Techniques include physical labels, headers and footers, metadata, watermarks and stamps. Digital information should carry metadata that supports identification, management and control, particularly for confidentiality, enables accurate searching, and lets systems act on the labels; procedures describe how metadata is attached, which labels apply and how data is handled, consistent with the information model and ICT architecture, and systems add further metadata as they process information. Staff and other interested parties are made aware of the procedures and trained to label and handle correctly. System output containing sensitive or critical information carries the right label. Other information: labels are central to information sharing; recording the creating process and time is useful; labels can also help attackers spot valuable assets; some systems protect everything at the highest level they may contain and label only on export.

Purpose in the standard’s terms, in our words: Communicates information classification and supports automated processing and management of information.

Attribute values in one line: Preventive; Confidentiality, Integrity, Availability; Protect; Information protection; Defence, Protection.

The five attribute values

These are the published values for this control, from ISO/IEC 27002:2022 clause 4.2 and Annex A Table A.1. Where your own value differs, record the difference and the reason in the same row rather than replacing the published value.

Evidence an auditor asks for

The attribute is a claim about how the control behaves. The evidence is what proves it operates. Keep both, and keep them together.

• Labelling procedures covering all formats, with rules on placement, exemptions and cases where labelling is not possible
• Examples of labelled documents, emails, reports and media showing the chosen techniques such as headers, watermarks or metadata
• Configuration of labelling or data classification tooling that applies metadata and enforces handling decisions
• Evidence that sensitive system outputs such as reports and exports carry classification labels
• Training records for personnel on labelling and handling
• Documented handling for systems that protect at the highest level and label on export

Where audits commonly find gaps

• Labels exist on documents but not in metadata, so DLP and other systems cannot act on them
• Reports and data exports from business systems carry no label
• Labelling rules for physical media and paper are missing
• Users are never trained, so labels are applied inconsistently or not at all

What ISO/IEC 27028 changes for this control

It carries a single control type, preventive, which sets what the evidence has to prove. It contributes no detect function, so a control set built from this row alone would not show detection. Its earlier numbering (08.2.2) is kept in the register so an older audit file can still be traced. It serves more than one security domain, which is why a domain count taken by row understates the view.

The guidance expands how the five values are used; it does not change the control or add a requirement. A register that carries the values and the evidence can answer the attribute question for this control without a new document. A register that does not can add the columns at the next SoA version, with an owner and a review date.

Controls that share its values

• 5.10 Acceptable use of information and other associated assets
• 5.12 Classification of information
• 5.14 Information transfer

Read the five attributes All 93 controls