Information Labelling and Handling Procedure Template (ISO/IEC 27001)

Label texts and formats, handling matrix from create to destroy per class, e-mail and file label settings, auto-labelling, paper and media, TLP mapping

SGSI e ISO/IEC 27001CompletaISO/IEC 27001:2022 + Amd 1:2024 A.5.12 to A.5.14, A.5.10, A.7.10, A.8.12 (cited only); ISO/IEC 27002:2022; NIST SP 800-88 Rev. 2; FIRST TLP 2.0information labelling handling procedureActualizada 1 nov 2026

Abrir en el editorDescargar .md

Cómo usar: Use it once your classification policy is approved, to tell people and tools how to label and handle information at each level. Fill the label texts, the handling matrix and the e-mail and file label settings first. The main pitfall is vague matrix cells or label spellings that differ between tools, so nothing can be enforced.

Vista previa

Information Labelling and Handling Procedure: [Organization name]

Procedure that makes the classification of information visible and tells every person what to do with information at each level when they create, store, use, share, print, transfer, keep and destroy it. It supports ISO/IEC 27001:2022 + Amd 1:2024 Annex A controls A.5.12 (classification), A.5.13 (labelling) and A.5.14 (transfer), together with A.5.10 (acceptable use), A.7.10 (storage media) and A.8.12 (data leakage prevention), with guidance from ISO/IEC 27002:2022. The classification levels themselves are defined in the data classification policy; this procedure applies them. Replace every [bracketed] value and every row marked Example.

Document control

Field	Value
Document ID	DOC-ISMS-042
Version	[1.0]
Status	[Draft / In review / Approved / Superseded]
Owner	[@isms-manager]
Approvers/reviewers	[@ciso], [@dpo], [@head-of-it], [@records-manager]
Last updated	YYYY-MM-DD
Classification	[Internal]
Standard and edition	ISO/IEC 27001:2022 + Amd 1:2024, Annex A A.5.12 to A.5.14, A.5.10, A.7.10, A.8.12; guidance ISO/IEC 27002:2022
Next scheduled review	YYYY-MM-DD (at least annually, and when the classification policy changes)
Classification scheme reference	[Data classification policy, version and date]
Labelling tools	[Productivity suite sensitivity labels / DLP tool / document management system]
Related documents	DOC-ISMS-001, DOC-ISMS-012, DOC-ISMS-040, DOC-ISMS-043, DOC-ISMS-056, DOC-ISMS-057, DOC-ISMS-062

Approvals

Role	Name	Decision	Date
Procedure owner	[@isms-manager]	[Prepared]	YYYY-MM-DD
Data protection officer or privacy lead	[@dpo]	[Reviewed]	YYYY-MM-DD
Head of IT	[@head-of-it]	[Reviewed: tool settings match]	YYYY-MM-DD
CISO or top management delegate	[@ciso]	[Approved]	YYYY-MM-DD

Revision history

Version	Date	Author	Change
1.0 (Example)	YYYY-MM-DD	[@isms-manager]	First approved procedure, aligned with classification policy v2.0
1.1 (Example)	YYYY-MM-DD	[@isms-manager]	Default label for new documents changed to Internal; automatic Restricted label for health identifiers added

Purpose and scope
Roles and responsibilities
Classification levels and label texts
Labelling methods by format
Handling matrix across the information lifecycle
E-mail and file labelling
Automated labelling and enforcement
Physical media and printed information
Unlabelled, mislabelled and relabelled information
Information received from third parties
Handling breaches and incidents
Training and awareness
Size tiers
Records and evidence
References

1. Purpose and scope

This procedure makes sure that information held or processed by [Organization name] carries a label that shows its classification, and that people and systems handle it according to that label throughout its life. It applies the levels defined in the data classification policy (data/data-classification-policy) and does not redefine them.

The procedure applies to all information in the ISMS scope (DOC-ISMS-002) in any form:

electronic documents, spreadsheets, presentations and PDFs;
e-mail, chat messages, meeting recordings and transcripts;
files in shared drives, cloud storage and collaboration sites;
structured data in databases, data warehouses and SaaS applications;
source code, configuration and logs that contain sensitive values;
printed documents, removable media and portable devices;
information shared verbally in meetings and calls.

It applies to employees, contractors and third parties who handle information on behalf of [Organization name]. Information owners are recorded in the asset inventory (compliance/asset-inventory, DOC-ISMS-012).

2. Roles and responsibilities

Role	Responsibilities
Information owner	Confirms the correct level for information sets in their area, approves downgrades, decides on external sharing of Confidential and Restricted information
Creator (any staff member)	Applies a label when creating or receiving information, checks inherited labels, follows the handling matrix
Recipient	Keeps the label, handles to the label, reports information that seems mislabelled
ISMS manager (procedure owner)	Maintains the procedure, label texts and handling matrix; reports metrics
IT or platform team	Configures labels, defaults, encryption and automatic labelling in tools; keeps settings aligned with this procedure
Security team	Operates DLP and discovery scans, triages label policy alerts, investigates handling breaches
Privacy lead or DPO	Defines personal data detectors and confirms handling rules for personal data
Records manager or office manager	Runs secure printing, storage of paper records, media destruction contracts

3. Classification levels and label texts

Level	Code	Visible label text	Machine-readable value	Default for
Public	C0	`PUBLIC`	`classification=C0`	Approved published content only
Internal	C1	`INTERNAL`	`classification=C1`	New documents and messages without another label
Confidential	C2	`CONFIDENTIAL`	`classification=C2`	Customer, employee, commercial and financial data
Restricted	C3	`RESTRICTED`	`classification=C3`	Special-category personal data, payment card data, bulk personal data extracts, secrets and security-critical data, board-only material

Optional sub-labels (also called flags or caveats) add handling information without adding levels:

Sub-label	Meaning	Effect
`PD`	Contains personal data	Minimum Confidential (C2); privacy rules apply; DLP personal data rules active
`PD-SC`	Contains special-category personal data	Only allowed at Restricted (C3)
`PD-CR`	Contains criminal offence personal data	Only allowed at Restricted (C3)
`PD-CHILD`	Contains personal data of children	Only allowed at Restricted (C3)
`PAY`	Contains full payment card numbers or sensitive authentication data	Only allowed at Restricted (C3); card data environment rules apply
`LEGAL-HOLD`	Under legal hold	Deletion blocked until the hold is released
`[CUSTOMER-NAME]-ONLY`	Customer-restricted data under contract	Shared only with staff assigned to that customer
`EXT-[LABEL]`	Original label from a third party (section 10)	Handled at the mapped internal level

The personal data and payment flags (PD, PD-SC, PD-CR, PD-CHILD, PAY, and PSEUDO or ANON where used) are defined in the data classification policy; use its spelling and minimum levels exactly.

4. Labelling methods by format

Format	Visible marking	Machine-readable marking	Applied by
Office documents and PDFs	Header or footer with the label text on every page; Restricted adds a watermark	Sensitivity label in file metadata	Creator, with default and automatic labelling
E-mail	Label shown in the message banner; Restricted adds the subject prefix `[RESTRICTED]`	Sensitivity label in message headers	Sender, with default label Internal
Chat and collaboration channels	Channel or team label in the channel description	Container sensitivity label	Channel owner at creation
Collaboration sites and shared folders	Site banner	Container label setting default label for files	Site owner, approved by information owner for C3
Meeting recordings and transcripts	Label in the meeting invitation and recording title	Inherited from the meeting label	Meeting organiser
Databases, warehouses and data sets	Label in the data catalogue entry	Table and column tags	Data owner, with discovery scans
SaaS application records	Field or record classification where supported, otherwise system-level label in the asset inventory	Application setting	System owner
Source code repositories	Repository description states the highest level	Repository topic or tag	Repository owner
Exports and extracts	Label in the file name, for example `customers_2026-10_C2.csv`	File metadata where the format allows	Person creating the export
Printed documents	Label printed in header or footer on every page	Not applicable	Inherited from the electronic file
Removable media and devices	Physical label with level and asset number	Encryption status recorded in the asset inventory	Asset holder
Verbal briefings	Speaker states the level at the start, for example "this briefing is Confidential"	Not applicable	Speaker

Public information may stay unlabelled once it has been approved for release. All other information is labelled.

5. Handling matrix across the information lifecycle

5.1 Create, store and use

Step	Public (C0)	Internal (C1)	Confidential (C2)	Restricted (C3)
Create	Mark as Public only after approval by the content owner	Default label applied automatically	Creator applies label at creation; template documents carry the label	Created only in approved Restricted locations; label applied before saving
Store electronically	Any approved system	Approved company systems	Approved systems with encryption at rest and access logging	Approved Restricted locations only, with encryption and access limited to named people or roles
Store on endpoint	Allowed	Allowed on managed devices	Managed, encrypted devices only; no local sync of whole sites	Not stored locally unless an exception is approved; access through the approved application
Access	Anyone	Staff and authorised contractors	Role-based, need to know (`isms/access-control-policy`)	Named individuals or narrow roles, owner approval, access reviewed quarterly
Use in AI tools	Allowed	Approved enterprise AI tools only	Approved tools cleared for C2 with no training on inputs (`ai-data/ai-usage-policy`)	Prohibited unless the tool is approved for C3
Discuss verbally	Anywhere	Not in public places	In private rooms or calls with known participants	Named participants only, no recording unless the information owner approves
Display on screen	No restriction	Lock screen when away (`isms/clear-desk-clear-screen-policy`)	Privacy screen in public places	Do not open in public places

5.2 Share and transfer

Step	Public (C0)	Internal (C1)	Confidential (C2)	Restricted (C3)
Share internally	Free	Free within the organisation	Need to know, through approved tools; share links limited to named people	Named people only, approved by the information owner; no "anyone in the organisation" links
Share externally	Free	Under an NDA or contract	Contract with confidentiality terms, and a data processing agreement when `PD` applies; information owner approves each new recipient organisation and any bulk data transfer	As Confidential plus information owner approval per recipient, encrypted channel, minimised content
E-mail externally	Allowed	Allowed to contracted parties	Allowed with label-driven encryption, enforced TLS to the partner domain, or an approved secure file share	Only through the approved secure transfer channel; plain e-mail attachments prohibited
Transfer method	Any	Approved channels in the transfer policy	Encrypted channels listed in `isms/information-transfer-policy`	Encrypted channels with recipient verification and transfer log
Removable media	Allowed	Encrypted media only	Encrypted, company-issued media, approved by line manager	Prohibited unless an exception is approved
Publish	After approval	Never	Never	Never

5.3 Print, keep and destroy

Step	Public (C0)	Internal (C1)	Confidential (C2)	Restricted (C3)
Print	Allowed	Allowed on company printers	Secure print release; collect at once	Avoid; if needed, secure print release and a numbered copy log
Store paper	No restriction	Not left on desks overnight	Locked drawer or cabinet	Locked cabinet in a controlled area, key or code held by named people
Take off-site	Allowed	Allowed	Only when needed, kept with the person	Only with information owner approval, in a closed folder or locked case
Post or courier	Any service	Standard mail	Tracked service, sealed envelope, no label on the outer envelope	Tracked service with signature, double envelope, inner envelope marked
Retain	Records schedule	Records schedule	Retention rule with trigger and period (`data/data-retention-deletion-standard`)	Shortest period that meets the purpose, documented basis
Destroy electronic	Normal delete	Normal delete	Delete plus removal from shares and trash; storage sanitised at end of life	As Confidential plus verified sanitisation per NIST SP 800-88 Rev. 2 and a disposal record
Destroy paper	Recycle	Recycle or confidential bin	Confidential waste bin, cross-cut shredding	Cross-cut shredding on site or witnessed destruction with a certificate
Destroy media and devices	Reuse allowed	Wipe before reuse	Sanitise before reuse or disposal	Sanitise or destroy, recorded in `isms/equipment-disposal-reuse-record`

6. E-mail and file labelling

Settings in the productivity suite and file storage:

Setting ID	Setting	Value
LBL-SET-001	Default label for new documents and e-mails	Internal (C1)
LBL-SET-002	Label mandatory before saving or sending	[Yes for documents and e-mail]
LBL-SET-003	Lowering a label	Allowed with a written justification, logged; lowering from Restricted needs information owner approval
LBL-SET-004	Confidential (C2) label effect	Footer marking; external sharing limited to authenticated recipients; download allowed on managed devices
LBL-SET-005	Restricted (C3) label effect	Header, footer and watermark; encryption with access limited to named groups; no forwarding or printing for external recipients; offline access limited to [7 days]
LBL-SET-006	Container labels	Sites and teams labelled at creation; files inherit the container label as default
LBL-SET-007	Label inheritance in e-mail	Replies and forwards keep the highest label in the thread; attachments raise the message label to their highest level
LBL-SET-008	Public label	Only users in the publishing group can apply Public

Rules for staff:

Check the label each time you create, receive or forward information.
When you combine information from several sources, use the highest level among them.
Do not remove markings from a document, print or export.
When in doubt, choose the higher level and ask the information owner.
Write the label justification in plain words when you lower a label, for example "personal data removed, aggregated figures only".

7. Automated labelling and enforcement

7.1 Automatic and recommended labels

Rule ID	Detector	Action	Scope
LBL-AUTO-001 (Example)	Payment card numbers (validated pattern)	Apply Restricted (C3) and `PAY` automatically	E-mail, files, chat
LBL-AUTO-002 (Example)	Health or patient identifiers from the customer data model	Apply Restricted (C3) and `PD-SC`	Files and databases at Quillmere Health Systems
LBL-AUTO-003 (Example)	National identity or passport number patterns for the countries served	Apply Restricted (C3)	Files, e-mail
LBL-AUTO-004 (Example)	10 or more e-mail addresses with names in one file	Recommend Confidential (C2) and `PD`	Files
LBL-AUTO-005 (Example)	Secrets: private keys, access tokens, connection strings	Apply Restricted (C3), alert the security team	Repositories, files, chat
[LBL-AUTO-NNN]	[detector]	[action]	[scope]

7.2 Enforcement links

DLP rules use the machine-readable labels to block or warn on transfers that break the matrix in section 5.2 (isms/data-masking-dlp-standard, DOC-ISMS-062).
Discovery scans of storage and data platforms report unlabelled or under-labelled content [monthly] to information owners.
Label changes, downgrades and policy overrides are logged and reviewed by the security team [weekly].

7.3 Labelling at creation

Every path ends with a label that travels with the information. The justification step is the only way to lower a label, and its log is the evidence reviewed in section 7.2.

8. Physical media and printed information

Removable media (USB drives, external disks, memory cards) is blocked by default on managed endpoints. Where allowed, only company-issued, encrypted media is used and it carries a physical label with the level and asset number.
Restricted media is held in a locked container in a controlled area and recorded in the asset inventory with its holder.
Printers use secure release (badge or PIN) for Confidential and Restricted printing. Uncollected jobs are purged after [24 hours].
Locked confidential waste bins are placed near printers and emptied by an approved destruction service that issues a certificate for each collection.
Paper and media leaving a site are logged (date, content level, carrier, recipient) when they are Restricted.
Devices and media at end of life are sanitised or destroyed and recorded in the equipment disposal and reuse record (isms/equipment-disposal-reuse-record, DOC-ISMS-057), with the method chosen according to NIST SP 800-88 Rev. 2.

9. Unlabelled, mislabelled and relabelled information

Situation	Rule
Unlabelled electronic information	Treated as Internal (C1) until labelled, unless a detector finds personal data, which raises it to Confidential (C2)
Information that seems under-labelled	Recipient raises the label or tells the information owner; the owner confirms within [5 working days]
Information that seems over-labelled	Recipient asks the information owner; the label stays until the owner decides
Planned downgrade (for example publication)	Information owner approves; the reason and date are logged; Public release follows the publication approval process
Time-based downgrade	Label may carry a review date, for example a results announcement that becomes Public at release
Legacy archives	Scanned and labelled in a planned project; until then access is limited to the archive owner group

10. Information received from third parties

External label or scheme	Internal level	Notes
Customer "Confidential" or "Strictly Confidential"	Confidential (C2) or Restricted (C3) as stated in the contract	Contract terms override the default mapping
TLP:CLEAR (TLP 2.0, FIRST)	Public (C0)	May be shared freely, subject to copyright
TLP:GREEN	Internal (C1)	Within the community, not published
TLP:AMBER	Confidential (C2)	Need to know within the organisation and its clients as the source allows
TLP:AMBER+STRICT	Confidential (C2), organisation only	No sharing with clients
TLP:RED	Restricted (C3), named recipients only	No further sharing
Government or regulator markings	As agreed with the authority	Record handling instructions in the authority contacts list (`isms/authority-special-interest-contacts`)

The original label is kept as an EXT- sub-label. When the third party's rule is stricter than the mapped internal rule, the stricter rule applies.

11. Handling breaches and incidents

Report any handling breach immediately through the security event reporting procedure (isms/security-event-reporting-procedure, DOC-ISMS-023). Examples: Confidential or Restricted information sent to the wrong recipient, uploaded to an unapproved service, printed and lost, or left unattended.
The security team assesses whether the event is an incident under the incident response plan (compliance/incident-response-plan, DOC-ISMS-020) and whether personal data breach rules apply (compliance/personal-data-breach-assessment).
Recall, deletion requests or link revocation are attempted at once where the tool allows.
Deliberate or repeated breaches are handled through the disciplinary process (isms/security-disciplinary-process, DOC-ISMS-052); honest mistakes reported promptly are treated as learning opportunities.

12. Training and awareness

All staff complete labelling training at onboarding and at each annual awareness cycle (security/security-awareness-program), with examples from their own work: a customer list, a board pack, a support ticket export.
Information owners and site owners receive extra guidance on approval of downgrades and external sharing.
A one-page summary of section 5 is published on the intranet and linked from the label selection dialog where the tool allows.
Completion is recorded in the competence and training matrix (isms/isms-competence-training-matrix, DOC-ISMS-026).

13. Size tiers

Topic	Small: Quillmere Analytics Ltd (46 staff)	Medium: Quillmere Health Systems (320 staff)	Large or multi-site: Quillmere Group (2,400 staff, 6 sites)
Labels	Four labels in the productivity suite, default Internal, manual labelling with recommended labels for customer data exports	Mandatory labelling for documents and e-mail, automatic Restricted label for health identifiers (LBL-AUTO-002)	Group label set in all tenants, translated label descriptions for 4 countries, same codes everywhere
Data platforms	Customer data store tagged at system level in the asset inventory	Column tags in the data catalogue for clinical scheduling data	Catalogue tags across IT data platforms; OT historian data labelled at system level per plant
Paper and media	Little paper; one locked bin at the office; USB blocked	Locked bins at both offices; media register at the colocation suite	Site records managers at each of the 6 sites; destruction contracts per country
Third-party labels	Customer contract terms mapped in the customer register	TLP mapping used for sector threat sharing	TLP plus authority markings at the data centre and plants
Ownership	ISMS manager (0.5 FTE) maintains the procedure and reviews downgrade logs monthly	3-person security team runs discovery scans and DLP triage	Security office runs a labelling service; site coordinators handle local paper and media

14. Records and evidence

Record	Proves	Owner	Location	Retention
Approved procedure and revision history	Labelling rules defined (A.5.13)	ISMS manager	Documented information register (DOC-ISMS-028)	Current plus [3] previous versions
Label configuration export	Tool settings match section 6	IT	Productivity suite admin export	Each change plus [3 years]
Label usage and downgrade logs	Labels applied; downgrades justified	Security team	Audit log platform	At least [1 year]
Discovery scan reports and remediation	Unlabelled content found and fixed	Security team, information owners	DLP or discovery tool	[3 years]
DLP alert triage records	Handling rules enforced (A.8.12)	Security team	DLP tool, ticketing	[3 years]
Certificates of destruction and disposal records	Secure destruction (A.7.10, A.7.14)	Records or office manager	DOC-ISMS-057	[6 years] or per records schedule
Restricted media and print logs	Restricted physical handling	Holders, records manager	Register	[3 years]
Training completion	Staff know the rules (A.6.3)	HR or ISMS manager	DOC-ISMS-026	[3 years]
Handling breach reports	Breaches reported and handled	Security team	Incident register (DOC-ISMS-021)	Per incident register retention

15. References

Reference	Edition	Use
ISO/IEC 27001:2022 + Amd 1:2024	2022, Amd 1 published 2024-02-23	Annex A A.5.10, A.5.12 to A.5.14, A.7.10, A.7.14, A.8.12 (cited by number)
ISO/IEC 27002:2022	2022	Guidance for classification, labelling and transfer controls
NIST SP 800-88 Rev. 2, Guidelines for Media Sanitization	Final, September 2025	Choice of sanitisation method in sections 5.3 and 8
FIRST Traffic Light Protocol (TLP) version 2.0	Authoritative from August 2022	External label mapping in section 10
ISO/IEC 27001 official page	https://www.iso.org/standard/82875.html	Purchase the standard
ISO/IEC 27002 official page	https://www.iso.org/standard/75652.html	Control guidance

Related templates: data/data-classification-policy, isms/information-transfer-policy (DOC-ISMS-043), isms/data-masking-dlp-standard (DOC-ISMS-062), isms/clear-desk-clear-screen-policy (DOC-ISMS-056), isms/equipment-disposal-reuse-record (DOC-ISMS-057), compliance/asset-inventory (DOC-ISMS-012), compliance/acceptable-use-policy (DOC-ISMS-040), data/data-retention-deletion-standard, isms/control-evidence-matrix (DOC-ISMS-033).

Standard and licence note

Structure aligned with ISO/IEC 27001:2022 + Amd 1:2024, Annex A controls A.5.12 to A.5.14 with A.5.10, A.7.10 and A.8.12, and with the guidance in ISO/IEC 27002:2022. The procedure text, label texts, rule IDs, examples and guidance are original wording; ISO/IEC text is not reproduced, and the short control labels are descriptions written for this library, not official titles. ISO and IEC standards are copyrighted: obtain the official standards from ISO (https://www.iso.org/standard/82875.html) or your national standards body. TLP label names are used as published by FIRST; sanitisation references point to NIST SP 800-88 Rev. 2. Check the current editions of all referenced standards before use. Template licence: MIT.

Plantillas relacionadas

SGSI e ISO/IEC 27001