SPRING DISCOUNT
Get 30% off on toolkits, course exams, and Conformio yearly plans.
Limited-time offer – ends April 25, 2024
Use promo code:
SPRING30

Expert Advice Community

Guest

Information Classification

  Quote
Guest
Guest user Created:   Nov 24, 2020 Last commented:   Nov 24, 2020

Information Classification

We’ve got some questions surrounding the development of our information classification policy.

The context is we are a three person company with literally tens of thousands of old documents spanning over a decade. Even the task of sorting through to purge  them ( which I actually don’t think we would want to) would probably be in feasible for us.

My specific questions are:

1 - Is there anything that would stop us from simply having two classifications Public and Confidential?

2 - Assuming we adopted a mandatory classification protocol at an individual document level on say December 1. What would be the recommendation as to classification of all pre-existing documents

3 - ...If the response is that every old document must  be classified this would be impossible for us. So therefore my next questions are around whether we can classify not at document level, but at a higher level.:

4 - Would it be legitimate to have a classification policy at a document type level?

5 - Or is it legitimate to classify based upon where the electronic document is stored (eg everything  in this Microsoft Teams channel is Confidential?

6- Overall any general thoughts / advice you may have for creation of a workable classification policy for such a small company?

0 0

Assign topic to the user

ISO 27001 DOCUMENTATION TOOLKIT

Step-by-step implementation for smaller companies.

ISO 27001 DOCUMENTATION TOOLKIT

Step-by-step implementation for smaller companies.

Expert
Rhand Leal Nov 24, 2020

1 - Is there anything that would stop us from simply having two classifications Public and Confidential?

ISO 27001 does not prescribe classifications to be applied to information, so it is acceptable by the standard that your organization may adopt only Public and Confidential levels.

2 - Assuming we adopted a mandatory classification protocol at an individual document level on say December 1. What would be the recommendation as to classification of all pre-existing documents

I'm assuming that by classification you mean define it as different from public.
 
Considering that, the classification of pre-existing documents will depend on your needs, the results of risk assessment, and applicable legal requirements.
 
For example, for HR processes you may need to classify all documents related to employees, regardless of how old they are (in most countries this related to laws or regulations). On the other hand, for the Marketing campaign for a new product, you only need to classify it until the new product is released.
 
It is important to note that the classification of information at the document level is impractical for a large number of documents.

3 - ...If the response is that every old document must  be classified this would be impossible for us. So therefore my next questions are around whether we can classify not at document level, but at a higher level.:

ISO 27001 does not prescribe levels to consider to classify information, so you can use the classification that better suits your needs. For example, you can classify documents according to type, the processes or business units they are related to, or where they are stored (e.g., contract type documents, documents related to the software development process, documents related to the HR department, or documents stored in the CFO office).  

4 - Would it be legitimate to have a classification policy at a document type level?

Considering previous answers, a classification policy at the document type level is acceptable for ISO 27001 certification purposes.

5 - Or is it legitimate to classify based upon where the electronic document is stored (eg everything  in this Microsoft Teams channel is Confidential?

Considering previous answers, classifying documents according to where they are located is acceptable for ISO 27001 certification purposes.  

6- Overall any general thoughts / advice you may have for creation of a workable classification policy for such a small company?

These articles will provide you a further explanation about information classification:

Quote
0 0

Comment as guest or Sign in

HTML tags are not allowed

Nov 24, 2020

Nov 24, 2020