Classification of digital information

ISO 27001 does not prescribe a way to classify information, so organizations can adopt the scheme which best fits their needs. The adopted scheme only needs to be aligned to perceived risks and applicable legal requirements.

Considering that, first you need to identify which legal requirements (e.g., laws, regulations, and contracts) and relevant risks, related to information confidentiality, integrity, and availability, are applicable to your context.

In general, information is classified in terms of its confidentiality, and an example of classification would be:

• Confidential (only specific people can access information)
• Restricted (only people who work in the town hall may have access to information)
• Public (information can be accessed by anyone)

Note that, if integrity or availability are relevant aspects to be taken into account, the classification scheme will be changed.

Please note that in case confidentiality or integrity are relevant aspects to be taken into account, the classification scheme will change.

So, you need to understand the needs of the prefectures to define the best classification scheme for them.

This article will provide you a further explanation about information classification:

• Information classification according to ISO 27001 https://advisera.com/27001academy/blog/2014/05/12/information-classification-according-to-iso-27001/