Information Classification Policy

All your company policies and legal agreements in one platform

What is an Information Classification Policy?

An information classification policy outlines the way a company organises access to the data they hold and the level of protection it should be given. By classifying information, the company can ensure that the information receives the appropriate level of protection.

Why is an Information Classification Policy important?

The starting point for information classification is creating your asset register. Once the company’s information is detailed in the register you can then classify that information typically in terms of confidentiality, with greater restrictions applied to access more sensitive information.

If you have grown to a point that you are considering data protection certifications such as ISO 27001, you will need to ensure that information receives an appropriate level of protection. Our policies and guidelines are designed to support those companies seeking certification.

ISO 27001 Information Classification Policy

InfoSec policies are part of the requirements of the ISO 27001 Certification standard. The Information Classification Policy is one of those ISO 27001 policies required, you can take a look at the full list here. This policy can be also know as the ISO 27001 Data Classification Policy.

Information Classification Policy Sections

Data ownership

Data custodians

The information classification process

Pre-classified information assets

Information Classification Policy Related

Also know as: Data Classification Policy, ISO 27001 Information Classification Policy, ISO 27001 Data Classification Policy, Data Classification and Labelling, ISO 27001 Asset Classification

Framework references: ISO 27001