Labelling of information

Why it matters

Classification only works if people can tell what they're looking at without asking.

How a self-led small team implements it

A footer or filename convention (e.g. "[Confidential]") is a legitimate labelling scheme for a small team.

What auditors expect to see

Sample labeled documents, labelling guideline.

More organizational controls

• A.5.1 Policies for information security
• A.5.2 Information security roles and responsibilities
• A.5.3 Segregation of duties
• A.5.4 Management responsibilities