A5.13: Labelling of Information

Labelling of information ensures that classified data is properly identified, handled, and protected according to its sensitivity. Without clear labelling, organizations risk data mishandling, unauthorized access, and regulatory non-compliance.

ISO 27001 A.5.13 requires organizations to implement a systematic approach to labelling information assets based on their classification. This applies to both physical and digital information, ensuring that employees and systems can easily recognize the required level of protection.

Implementation Guide #

Step 1: Define Labelling Standards

Organizations should develop clear labelling standards that align with their classification policy (A.5.12). Common labelling methods include:

• Text Labels: Adding classification labels (e.g., “Confidential”) in document headers, footers, or watermarks.
• Metadata Tags: Assigning classification tags to digital files and emails.
• Color Coding: Using specific colors for different sensitivity levels.
• Physical Labels: Marking printed documents, storage devices, and physical files with classification labels.

Step 2: Implement Labelling Mechanisms

• Ensure all digital documents, emails, and databases support automated classification and labelling.
• Use DLP (Data Loss Prevention) tools to enforce labelling and prevent misclassification.
• Apply encryption and access controls based on classification labels.
• Implement automated email disclaimers for sensitive emails (e.g., “This email contains confidential information”).

Step 3: Train Employees on Labelling

• Provide guidelines on how to correctly label information.
• Conduct awareness training on handling and sharing labelled information.
• Educate employees on the consequences of incorrect labelling (e.g., data leaks, compliance breaches).

Step 4: Monitor and Audit Compliance

• Regularly review labelled data to ensure consistency.
• Use audits and DLP reports to check for mislabelled or unlabelled sensitive data.
• Update labelling policies based on business and regulatory changes.

Templates #

Information Labelling Policy Template
Digital File & Email Labelling Guide
Physical Document Label Examples

Example #

A healthcare provider classifies patient records as Highly Confidential. They implement the following labelling methods:

• Electronic records: Encrypted and marked as “Confidential – Patient Data.”
• Printed documents: Stamped with “Confidential – Do Not Distribute.”
• Emails containing patient data: Auto-tagged with “Sensitive – Encrypted Transmission Only.”

If an employee mistakenly sends an unlabelled patient record to an external recipient, it could lead to HIPAA violations and regulatory fines.

How to Comply #

To comply with ISO 27001 A.5.13, organizations should:

• Define and document clear labelling policies.
• Implement automated labelling mechanisms in digital systems.
• Conduct regular training and audits to ensure adherence.

How to Pass an Audit #

Key Documents to Prepare:

• Information Labelling Policy
• Data Classification & Labelling Guidelines
• Evidence of Employee Training on Labelling

What the Auditor Will Check:

• Is there a consistent labelling system in place?
• Are classification labels clearly defined and applied correctly?
• Do employees understand and follow labelling guidelines?

Top 3 Mistakes People Make #

• Not Enforcing Labelling Rules – Documents and emails remain unlabelled, increasing security risks.
• Failure to Train Employees – Staff mishandle sensitive data due to lack of awareness.
• Inconsistent Labelling – Different departments use different labelling methods, causing confusion.

ISO 27001 Labelling of Information FAQ #

Q1: Do all files and documents require labelling?
Not necessarily. Labelling should be applied based on classification policies, focusing on sensitive and critical information.

Q2: Can labelling be automated?
Yes, many DLP and document management systems offer automated classification and labelling.

Q3: What’s the best way to label digital files?
Using metadata tagging, headers/footers, and digital watermarks ensures files are properly labelled.

ISO 27001 Controls and Attribute Values #

A robust labelling system enhances data security, prevents leaks, and ensures compliance with regulatory requirements like GDPR, HIPAA, and PCI DSS. Organizations that fail to label information correctly face risks such as data breaches, financial penalties, and reputational damage.

Action Step: Review your labelling policy today—ensure all sensitive information is correctly labelled and protected.