Information classification is the process of categorizing an organisation’s information based on how sensitive and critical it is. It’s about understanding which information requires the highest level of protection and which can be handled more openly.
For organisations working with ISO 27001, information classification is a fundamental security control. It helps you protect the right information in the right way — not more and not less than necessary.
Consider how different types of information affect your organisation if they fall into the wrong hands:
Personal data with national identity numbers and payroll details – If these are leaked you risk GDPR fines and loss of employee trust.
Customer records with contact details – Less sensitive than personal data but still valuable to competitors and harmful if abused.
Public press releases – No harm if these are shared, since they are intended for the public.
Without information classification many organisations treat all information the same. That leads to two problems:
Information classification solves this by assigning an appropriate protection level to each type of information.
ISO 27001:2022 Annex A control 5.12 (Classification of information) states that organisations must classify information based on:
The standard also requires that you:
There are several established systems for information classification. The choice depends on your organisation, industry and any legal requirements.
SIS and MSB use 5-level scales:
These schemes suit Swedish organisations and legislation well. They also provide flexibility when you need to map protection levels to other countries’ classifications during international collaboration.
The US, UK, Germany and France have their own classification standards. Norway, Denmark and Finland generally use 5-level systems similar to Sweden.
Recommendation for Swedish organisations: use a 5-level system such as SIS or MSB. They are more nuanced than 3-level schemes and easier to align with other countries’ classifications when working internationally.
Here’s a concrete example from a Swedish manufacturing company:
Assessment:
Overall classification: Level 5 (the highest of the three)
Security measures that follow:
Assessment:
Overall classification: Level 2
Security measures that follow:
The difference in security measures is significant — and entirely reasonable given the information’s value to the business.
Information classification is the starting point for your information security risk management.
When you know which information is most critical you can:
Without classification, risk assessment becomes guesswork. With classification you have a fact-based foundation.
Some organisations classify almost everything as “confidential” or higher. This leads to:
Solution: Be honest about what truly is sensitive. Public information should be classified as public.
Other organisations classify too low to “simplify”. This leads to:
Solution: Consider the consequences if the information is disclosed, altered or unavailable.
Information changes over time. A production recipe that was top secret last year may be less critical now if the product is being phased out.
Solution: Review classifications regularly — at least annually.
When HR classifies personnel data as level 3 but Finance classifies the same data as level 4, confusion and security gaps occur.
Solution: Create a clear organisation-wide policy and train everyone who classifies information.
Information classification supports several other ISO 27001 controls:
Annex A 5.9 – Inventory of assets
You must know what information you have before you can classify it.
Annex A 5.10 – Acceptable use of information
Classification determines the rules for how information may be used.
Annex A 5.13 – Labelling of information
Label information according to its classification where appropriate (e.g., “Confidential” in the footer).
Annex A 8.12 – Preventive measures against data leakage
Information with a high classification needs stronger protections against leakage.
In ISO 27001 implementation projects our consultants set up a tailored information classification matrix as a starting point for your organisation. Depending on the project level (mini, midi or maxi) you receive different levels of support to adapt the classification system to your needs.
This template helps you to:
If you are going to implement information classification in your organisation, follow these steps:
Decide whether to use SIS, MSB or another system. For Swedish organisations we recommend a 5-level scheme.
Write clear descriptions for each level that fit your organisation:
List all important information:
For each item, assess:
The highest rating becomes the overall classification.
Ensure controls match the classification levels:
Information classification is not bureaucratic overhead — it is the foundation for effective information security.
When you know which information is most valuable and sensitive you can:
For organisations working with ISO 27001, information classification is mandatory under Annex A control 5.12. Even if you do not pursue certification, it is a powerful tool to protect what matters most to your organisation.
Start by identifying your most critical information and classify it. Then expand the system step by step. With the right structure and tools it doesn’t have to be complicated.
Related articles:
