Information Classification Policy

The need for labeling historical data will depend on the results of risk assessment and applicable legal requirements (e.g., laws, regulations, or contracts).

For example, due to relevant risks or a contract with customers, you may need to keep at least the historical data from two previous years classified, so you need to label them according to the related information classification level.

In most cases we see that companies are not classifying documents and records created before the start of the ISO 27001 project.

For further information, see:

• Information classification according to ISO 27001 https://advisera.com/27001academy/blog/2014/05/12/information-classification-according-to-iso-27001/