Information Classification
What is Information Classification?
A governance process that categorizes information assets based on their sensitivity and criticality to determine appropriate protection measures.
Terms that appear alongside information classification
Each of these is named in at least one of the same controls as information classification. The number is how many controls name both.
- asset management 7 shared controls
- policy 4 shared controls
- audit 2 shared controls
- data classification 2 shared controls
- confidentiality 2 shared controls
- nist 2 shared controls
- annex a 2 shared controls
- availability 2 shared controls
Frameworks that govern information classification
What the standards actually require on information classification
Requirements naming information classification across 6 standards, quoted from the control text.
The information classification scheme must explicitly account for personal data, including its type and any special categories, so the organization knows what it processes, where it is stored and which systems it flows through, and the people under its control...
iso-27701-2019::6.5.2 · Information classification →Operate asset management + information classification per Oman National Cybersecurity Framework. Maintain inventory of information systems + networks + endpoints + applications + data with documented owners + classification + criticality + protection requireme...
OMANCS-2 · Asset Management and Information Classification →Maintain and issue encryption and key management policies that mandate state-of-the-art algorithms and network protocols, tie encryption strength to the information classification scheme, cover the full key lifecycle, and reflect applicable legal obligations.
C5-CRY-01 · Policy for the use of encryption procedures and key management →Gives the general principles for managing technology risk: IT governance (control policies, oversight and organisation of IT, a technology risk management function, technology audits, staff competence, IT support from overseas offices);
hkma-spm::TM-G-1 · TM-G-1 General Principles for Technology Risk Management →NSS-17 + NSS-42-G require vulnerability + patch management + removable media + portable device controls. Vulnerability management: vendor security advisories + CVE feeds + ICS-CERT + national CERT subscriptions;
IAEA-NSS17-Vulnerability-Patch-RemovableMedia-Portable · IAEA NSS-17 - Vulnerability Management + Patch + Removable Media + Portable Device Control →Procedures for labelling information are to be developed and put into effect in line with the classification scheme the organization has adopted.
iso-27001-2022::5.13 · Labelling of information →Questions people ask about information classification
What is Information Classification?
Why is Information Classification important for compliance?
Which compliance frameworks address Information Classification?
Where can I learn more about Information Classification?
See how Information Classification applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.