Information Classification and Handling Procedure

1. Purpose

This procedure turns the Information Classification and Handling Policy into daily practice. It tells every person how to decide which classification level applies to a piece of information, how to mark it so the level is visible, how to store, share, print, carry and transmit it, and how to destroy it, together with the media that held it, when it is no longer needed.

It is written so that a new joiner can follow it without asking for help, and so that an auditor can pick any step and find the evidence that it was performed.

2. Scope

The procedure applies to all information created, received, processed, stored or transmitted by or for the Organisation, in any form: electronic files, email and messages, databases, paper, removable media, recordings, images, and information held in people's memory when it is repeated in writing or speech.

• In scope: employees, contractors, interns, consultants and suppliers who handle Organisation information; all Organisation-owned and approved personal devices; all locations, including home and travel; all cloud services holding Organisation information.
• In scope: all media that holds information, including laptops, servers, storage arrays, backup media, removable drives, mobile devices, printers and multifunction devices with storage, and paper.
• Out of scope: information that is already public by lawful release and has been recorded as such in the classification register; personal information of an individual that has no connection with the Organisation, even if it is held on an Organisation device.

3. Terms and Definitions

4. Roles and Responsibilities

5. Classification Levels

Every item takes the level that matches the worst outcome if it were disclosed, altered or lost. Where one document contains parts at different levels, the whole document takes the highest level until the parts are separated.

6. Classification Procedure

1. Identify the ownerThe creator or the receiving team names the information owner. If the item is received from outside, the recipient's line manager is the owner until reassigned. Target: at creation or receipt.
2. Assess impactAsk what would happen if the item became public, changed without notice, or were unavailable for [one day]. Consider customer, legal, contractual and personal data effects. Use the classification matrix in this procedure.
3. Assign the levelChoose the highest level that applies. Record it for any collection of items in the classification register (Annexure A). Target: within [5 working days].
4. LabelApply the label as described in the labelling rules below before the item is stored or shared.
5. ReviewOwners review levels [annually] and when the item changes purpose, is shared in new ways, or after an incident. Downgrade only when the sensitivity has demonstrably ended, for example after public announcement.

7. Information Labelling

A label must be visible to a person at the time of use and, where possible, readable by tools such as data loss prevention and email gateways. The label wording is exactly one of the four level names.

7.1 Labelling by format

7.2 Labelling rules

• Unlabelled information is treated as [Internal] for reading and as [Confidential] for sharing outside the Organisation until the owner confirms.
• When extracts from several items are combined, the new item takes the highest level among them.
• A label may be raised by anyone who sees the need; it may be lowered only by the information owner, with a note in the register.
• Do not put the level in a form that discloses sensitive content, such as a file name containing a customer's personal details.
• Information received from a customer or partner keeps the label they applied and is also mapped to the nearest level in this procedure; the stricter of the two applies.
• Where labelling is impractical, such as for streaming logs or machine-to-machine data, the level is set at system level and recorded in the asset register.

8. Information Handling

The matrix below sets the minimum handling for each level. Where a customer contract or applicable law demands more, the stricter rule applies.

8.1 Handling expectations for everyone

• Collect printouts immediately and never leave Confidential or Restricted paper on a printer, desk or meeting room table.
• Do not discuss Confidential or Restricted information in lifts, cafes, public transport or on open video calls.
• Before sending, check recipients, attachments and the level label; use delayed send or recipient confirmation for external Confidential email.
• Share by access-controlled link with an expiry in preference to attachments, and remove access when the work ends.
• Keep Restricted information out of test and development environments; if copies are required, mask or substitute the data.
• Report any suspected loss, exposure or sharing in error to the service desk within [1 hour]. Do not attempt to retrieve or delete without advice.

8.2 Transfer outside the Organisation

1. RequestThe sender states recipient, purpose, items, level and method in the transfer register (Annexure B) for Confidential and Restricted items.
2. ApproveThe information owner approves; for Restricted, the Head of IT Security also approves. Target: [1 working day].
3. ProtectEncrypt the item with an approved method and send the passphrase or key through a different channel from the data.
4. ConfirmAsk the recipient to acknowledge receipt and the expected handling. Record the acknowledgement.
5. CloseRemove temporary links and copies after [30 days] or when the purpose ends, whichever is earlier.

9. Information and Media Disposal

Information is disposed of when its retention period in the Documents and Records Management Procedure ends, when the business purpose ends, or when a customer or law requires deletion. Media is sanitised before it is reused, repaired by a third party, returned to a lessor or discarded. The detailed asset side of this is in the Asset Disposal Process.

9.1 Disposal methods by media

9.2 Disposal procedure

1. IdentifyThe custodian lists the items due for disposal from the asset register or the retention schedule. Input: asset list or expiry report.
2. Check holdsThe owner confirms there is no legal, audit, investigation or contract hold on the items. A hold stops disposal. Target: [3 working days].
3. SecureStore the items in a locked cage or cabinet marked for disposal until collection; keep a custody sheet.
4. SanitiseApply the method in the table. For third-party destruction, use an approved vendor under contract and witness or record collection.
5. VerifyA second person checks a sample of sanitised items, or the full set for Restricted, and signs the disposal record (Annexure C).
6. RecordUpdate the asset register to Disposed, attach certificates, and keep the record for [3 years].

9.3 Rules for disposal

• Media that held Confidential or Restricted information never leaves Organisation control until it has been sanitised or destroyed.
• Sanitisation by a supplier is allowed only where the contract requires approved methods, personnel vetting, chain of custody and a certificate.
• Devices sold, donated or re-issued internally are sanitised and re-imaged first; a new user must never see the previous user's data.
• Information in recycle bins, shared drives, chat history and personal drives is deleted according to the retention schedule, not left to accumulate.
• Personal data is deleted when its purpose ends, and the deletion is recorded so that a data subject request can be answered. See the Data Protection and Privacy Procedure.

10. Measures

11. Records and Evidence

Annexure A: Classification register

Annexure B: External transfer register

Annexure C: Media sanitisation and disposal record

12. Exception

Exceptions to this document are allowed only where compliance is not practicable and the risk has been assessed. A request must state what is to be excepted, why, the risk it creates, the compensating controls, and an end date no later than [6 months]. It is approved in writing by the document owner and the risk owner, recorded in the exceptions register, and reviewed at the end date. An exception does not change the document.

13. Enforcement

Compliance is monitored through internal audits, management review and routine checks by the document owner. Non-compliance is reported through the incident or non-conformity process and handled under the organisation's disciplinary procedure, and under the terms of any contract for people who are not employees. Serious or repeated non-compliance may lead to loss of access and, where the law is broken, to referral to the authorities.

14. Review

This document is reviewed at least every [12 months], and when there is a significant change to the organisation, its systems, its risks or the law, or after an incident that shows it was not effective. Each review is recorded in the revision history.

ISO/IEC 27001:2022 references

Related documents

• Information Classification and Handling Policy
• Asset Disposal Process
• Asset Management Procedure
• Data Protection and Privacy Procedure
• Acceptable Usage Policy
• Cryptography Procedure