# Information Labelling and Handling Procedure: [Organization name] > Procedure that makes the classification of information visible and > tells every person what to do with information at each level when they > create, store, use, share, print, transfer, keep and destroy it. It > supports ISO/IEC 27001:2022 + Amd 1:2024 Annex A controls A.5.12 > (classification), A.5.13 (labelling) and A.5.14 (transfer), together > with A.5.10 (acceptable use), A.7.10 (storage media) and A.8.12 (data > leakage prevention), with guidance from ISO/IEC 27002:2022. The > classification levels themselves are defined in the data > classification policy; this procedure applies them. Replace every > `[bracketed]` value and every row marked *Example*. ## Document control | Field | Value | |---|---| | Document ID | DOC-ISMS-042 | | Version | [1.0] | | Status | [Draft / In review / Approved / Superseded] | | Owner | [@isms-manager] | | Approvers/reviewers | [@ciso], [@dpo], [@head-of-it], [@records-manager] | | Last updated | YYYY-MM-DD | | Classification | [Internal] | | Standard and edition | ISO/IEC 27001:2022 + Amd 1:2024, Annex A A.5.12 to A.5.14, A.5.10, A.7.10, A.8.12; guidance ISO/IEC 27002:2022 | | Next scheduled review | YYYY-MM-DD (at least annually, and when the classification policy changes) | | Classification scheme reference | [Data classification policy, version and date] | | Labelling tools | [Productivity suite sensitivity labels / DLP tool / document management system] | | Related documents | DOC-ISMS-001, DOC-ISMS-012, DOC-ISMS-040, DOC-ISMS-043, DOC-ISMS-056, DOC-ISMS-057, DOC-ISMS-062 | ### Approvals | Role | Name | Decision | Date | |---|---|---|---| | Procedure owner | [@isms-manager] | [Prepared] | YYYY-MM-DD | | Data protection officer or privacy lead | [@dpo] | [Reviewed] | YYYY-MM-DD | | Head of IT | [@head-of-it] | [Reviewed: tool settings match] | YYYY-MM-DD | | CISO or top management delegate | [@ciso] | [Approved] | YYYY-MM-DD | ### Revision history | Version | Date | Author | Change | |---|---|---|---| | 1.0 *(Example)* | YYYY-MM-DD | [@isms-manager] | First approved procedure, aligned with classification policy v2.0 | | 1.1 *(Example)* | YYYY-MM-DD | [@isms-manager] | Default label for new documents changed to Internal; automatic Restricted label for health identifiers added | ## Contents 1. Purpose and scope 2. Roles and responsibilities 3. Classification levels and label texts 4. Labelling methods by format 5. Handling matrix across the information lifecycle 6. E-mail and file labelling 7. Automated labelling and enforcement 8. Physical media and printed information 9. Unlabelled, mislabelled and relabelled information 10. Information received from third parties 11. Handling breaches and incidents 12. Training and awareness 13. Size tiers 14. Records and evidence 15. References ## 1. Purpose and scope This procedure makes sure that information held or processed by [Organization name] carries a label that shows its classification, and that people and systems handle it according to that label throughout its life. It applies the levels defined in the data classification policy (`data/data-classification-policy`) and does not redefine them. The procedure applies to all information in the ISMS scope (DOC-ISMS-002) in any form: - electronic documents, spreadsheets, presentations and PDFs; - e-mail, chat messages, meeting recordings and transcripts; - files in shared drives, cloud storage and collaboration sites; - structured data in databases, data warehouses and SaaS applications; - source code, configuration and logs that contain sensitive values; - printed documents, removable media and portable devices; - information shared verbally in meetings and calls. It applies to employees, contractors and third parties who handle information on behalf of [Organization name]. Information owners are recorded in the asset inventory (`compliance/asset-inventory`, DOC-ISMS-012). ## 2. Roles and responsibilities | Role | Responsibilities | |---|---| | Information owner | Confirms the correct level for information sets in their area, approves downgrades, decides on external sharing of Confidential and Restricted information | | Creator (any staff member) | Applies a label when creating or receiving information, checks inherited labels, follows the handling matrix | | Recipient | Keeps the label, handles to the label, reports information that seems mislabelled | | ISMS manager (procedure owner) | Maintains the procedure, label texts and handling matrix; reports metrics | | IT or platform team | Configures labels, defaults, encryption and automatic labelling in tools; keeps settings aligned with this procedure | | Security team | Operates DLP and discovery scans, triages label policy alerts, investigates handling breaches | | Privacy lead or DPO | Defines personal data detectors and confirms handling rules for personal data | | Records manager or office manager | Runs secure printing, storage of paper records, media destruction contracts | ## 3. Classification levels and label texts | Level | Code | Visible label text | Machine-readable value | Default for | |---|---|---|---|---| | Public | C0 | `PUBLIC` | `classification=C0` | Approved published content only | | Internal | C1 | `INTERNAL` | `classification=C1` | New documents and messages without another label | | Confidential | C2 | `CONFIDENTIAL` | `classification=C2` | Customer, employee, commercial and financial data | | Restricted | C3 | `RESTRICTED` | `classification=C3` | Special-category personal data, payment card data, bulk personal data extracts, secrets and security-critical data, board-only material | Optional sub-labels (also called flags or caveats) add handling information without adding levels: | Sub-label | Meaning | Effect | |---|---|---| | `PD` | Contains personal data | Minimum Confidential (C2); privacy rules apply; DLP personal data rules active | | `PD-SC` | Contains special-category personal data | Only allowed at Restricted (C3) | | `PD-CR` | Contains criminal offence personal data | Only allowed at Restricted (C3) | | `PD-CHILD` | Contains personal data of children | Only allowed at Restricted (C3) | | `PAY` | Contains full payment card numbers or sensitive authentication data | Only allowed at Restricted (C3); card data environment rules apply | | `LEGAL-HOLD` | Under legal hold | Deletion blocked until the hold is released | | `[CUSTOMER-NAME]-ONLY` | Customer-restricted data under contract | Shared only with staff assigned to that customer | | `EXT-[LABEL]` | Original label from a third party (section 10) | Handled at the mapped internal level | The personal data and payment flags (`PD`, `PD-SC`, `PD-CR`, `PD-CHILD`, `PAY`, and `PSEUDO` or `ANON` where used) are defined in the data classification policy; use its spelling and minimum levels exactly. ## 4. Labelling methods by format | Format | Visible marking | Machine-readable marking | Applied by | |---|---|---|---| | Office documents and PDFs | Header or footer with the label text on every page; Restricted adds a watermark | Sensitivity label in file metadata | Creator, with default and automatic labelling | | E-mail | Label shown in the message banner; Restricted adds the subject prefix `[RESTRICTED]` | Sensitivity label in message headers | Sender, with default label Internal | | Chat and collaboration channels | Channel or team label in the channel description | Container sensitivity label | Channel owner at creation | | Collaboration sites and shared folders | Site banner | Container label setting default label for files | Site owner, approved by information owner for C3 | | Meeting recordings and transcripts | Label in the meeting invitation and recording title | Inherited from the meeting label | Meeting organiser | | Databases, warehouses and data sets | Label in the data catalogue entry | Table and column tags | Data owner, with discovery scans | | SaaS application records | Field or record classification where supported, otherwise system-level label in the asset inventory | Application setting | System owner | | Source code repositories | Repository description states the highest level | Repository topic or tag | Repository owner | | Exports and extracts | Label in the file name, for example `customers_2026-10_C2.csv` | File metadata where the format allows | Person creating the export | | Printed documents | Label printed in header or footer on every page | Not applicable | Inherited from the electronic file | | Removable media and devices | Physical label with level and asset number | Encryption status recorded in the asset inventory | Asset holder | | Verbal briefings | Speaker states the level at the start, for example "this briefing is Confidential" | Not applicable | Speaker | Public information may stay unlabelled once it has been approved for release. All other information is labelled. ## 5. Handling matrix across the information lifecycle ### 5.1 Create, store and use | Step | Public (C0) | Internal (C1) | Confidential (C2) | Restricted (C3) | |---|---|---|---|---| | Create | Mark as Public only after approval by the content owner | Default label applied automatically | Creator applies label at creation; template documents carry the label | Created only in approved Restricted locations; label applied before saving | | Store electronically | Any approved system | Approved company systems | Approved systems with encryption at rest and access logging | Approved Restricted locations only, with encryption and access limited to named people or roles | | Store on endpoint | Allowed | Allowed on managed devices | Managed, encrypted devices only; no local sync of whole sites | Not stored locally unless an exception is approved; access through the approved application | | Access | Anyone | Staff and authorised contractors | Role-based, need to know (`isms/access-control-policy`) | Named individuals or narrow roles, owner approval, access reviewed quarterly | | Use in AI tools | Allowed | Approved enterprise AI tools only | Approved tools cleared for C2 with no training on inputs (`ai-data/ai-usage-policy`) | Prohibited unless the tool is approved for C3 | | Discuss verbally | Anywhere | Not in public places | In private rooms or calls with known participants | Named participants only, no recording unless the information owner approves | | Display on screen | No restriction | Lock screen when away (`isms/clear-desk-clear-screen-policy`) | Privacy screen in public places | Do not open in public places | ### 5.2 Share and transfer | Step | Public (C0) | Internal (C1) | Confidential (C2) | Restricted (C3) | |---|---|---|---|---| | Share internally | Free | Free within the organisation | Need to know, through approved tools; share links limited to named people | Named people only, approved by the information owner; no "anyone in the organisation" links | | Share externally | Free | Under an NDA or contract | Contract with confidentiality terms, and a data processing agreement when `PD` applies; information owner approves each new recipient organisation and any bulk data transfer | As Confidential plus information owner approval per recipient, encrypted channel, minimised content | | E-mail externally | Allowed | Allowed to contracted parties | Allowed with label-driven encryption, enforced TLS to the partner domain, or an approved secure file share | Only through the approved secure transfer channel; plain e-mail attachments prohibited | | Transfer method | Any | Approved channels in the transfer policy | Encrypted channels listed in `isms/information-transfer-policy` | Encrypted channels with recipient verification and transfer log | | Removable media | Allowed | Encrypted media only | Encrypted, company-issued media, approved by line manager | Prohibited unless an exception is approved | | Publish | After approval | Never | Never | Never | ### 5.3 Print, keep and destroy | Step | Public (C0) | Internal (C1) | Confidential (C2) | Restricted (C3) | |---|---|---|---|---| | Print | Allowed | Allowed on company printers | Secure print release; collect at once | Avoid; if needed, secure print release and a numbered copy log | | Store paper | No restriction | Not left on desks overnight | Locked drawer or cabinet | Locked cabinet in a controlled area, key or code held by named people | | Take off-site | Allowed | Allowed | Only when needed, kept with the person | Only with information owner approval, in a closed folder or locked case | | Post or courier | Any service | Standard mail | Tracked service, sealed envelope, no label on the outer envelope | Tracked service with signature, double envelope, inner envelope marked | | Retain | Records schedule | Records schedule | Retention rule with trigger and period (`data/data-retention-deletion-standard`) | Shortest period that meets the purpose, documented basis | | Destroy electronic | Normal delete | Normal delete | Delete plus removal from shares and trash; storage sanitised at end of life | As Confidential plus verified sanitisation per NIST SP 800-88 Rev. 2 and a disposal record | | Destroy paper | Recycle | Recycle or confidential bin | Confidential waste bin, cross-cut shredding | Cross-cut shredding on site or witnessed destruction with a certificate | | Destroy media and devices | Reuse allowed | Wipe before reuse | Sanitise before reuse or disposal | Sanitise or destroy, recorded in `isms/equipment-disposal-reuse-record` | ## 6. E-mail and file labelling Settings in the productivity suite and file storage: | Setting ID | Setting | Value | |---|---|---| | LBL-SET-001 | Default label for new documents and e-mails | Internal (C1) | | LBL-SET-002 | Label mandatory before saving or sending | [Yes for documents and e-mail] | | LBL-SET-003 | Lowering a label | Allowed with a written justification, logged; lowering from Restricted needs information owner approval | | LBL-SET-004 | Confidential (C2) label effect | Footer marking; external sharing limited to authenticated recipients; download allowed on managed devices | | LBL-SET-005 | Restricted (C3) label effect | Header, footer and watermark; encryption with access limited to named groups; no forwarding or printing for external recipients; offline access limited to [7 days] | | LBL-SET-006 | Container labels | Sites and teams labelled at creation; files inherit the container label as default | | LBL-SET-007 | Label inheritance in e-mail | Replies and forwards keep the highest label in the thread; attachments raise the message label to their highest level | | LBL-SET-008 | Public label | Only users in the publishing group can apply Public | Rules for staff: - Check the label each time you create, receive or forward information. - When you combine information from several sources, use the highest level among them. - Do not remove markings from a document, print or export. - When in doubt, choose the higher level and ask the information owner. - Write the label justification in plain words when you lower a label, for example "personal data removed, aggregated figures only". ## 7. Automated labelling and enforcement ### 7.1 Automatic and recommended labels | Rule ID | Detector | Action | Scope | |---|---|---|---| | LBL-AUTO-001 *(Example)* | Payment card numbers (validated pattern) | Apply Restricted (C3) and `PAY` automatically | E-mail, files, chat | | LBL-AUTO-002 *(Example)* | Health or patient identifiers from the customer data model | Apply Restricted (C3) and `PD-SC` | Files and databases at Quillmere Health Systems | | LBL-AUTO-003 *(Example)* | National identity or passport number patterns for the countries served | Apply Restricted (C3) | Files, e-mail | | LBL-AUTO-004 *(Example)* | 10 or more e-mail addresses with names in one file | Recommend Confidential (C2) and `PD` | Files | | LBL-AUTO-005 *(Example)* | Secrets: private keys, access tokens, connection strings | Apply Restricted (C3), alert the security team | Repositories, files, chat | | [LBL-AUTO-NNN] | [detector] | [action] | [scope] | ### 7.2 Enforcement links - DLP rules use the machine-readable labels to block or warn on transfers that break the matrix in section 5.2 (`isms/data-masking-dlp-standard`, DOC-ISMS-062). - Discovery scans of storage and data platforms report unlabelled or under-labelled content [monthly] to information owners. - Label changes, downgrades and policy overrides are logged and reviewed by the security team [weekly]. ### 7.3 Labelling at creation ```mermaid flowchart TD A["Information created or received"] --> B{"Inherited or default label?"} B -- "Yes" --> C["Creator checks the label"] B -- "No" --> D["Creator selects a label"] C --> E{"Automatic detector matches?"} D --> E E -- "Yes, higher level" --> F["Label raised or recommended"] E -- "No" --> G["Label kept"] F --> H["Handle per matrix in section 5"] G --> H H --> I{"User lowers label?"} I -- "Yes" --> J["Justification logged, owner approval if from Restricted"] I -- "No" --> K["Label stays with every copy"] J --> K ``` Every path ends with a label that travels with the information. The justification step is the only way to lower a label, and its log is the evidence reviewed in section 7.2. ## 8. Physical media and printed information - Removable media (USB drives, external disks, memory cards) is blocked by default on managed endpoints. Where allowed, only company-issued, encrypted media is used and it carries a physical label with the level and asset number. - Restricted media is held in a locked container in a controlled area and recorded in the asset inventory with its holder. - Printers use secure release (badge or PIN) for Confidential and Restricted printing. Uncollected jobs are purged after [24 hours]. - Locked confidential waste bins are placed near printers and emptied by an approved destruction service that issues a certificate for each collection. - Paper and media leaving a site are logged (date, content level, carrier, recipient) when they are Restricted. - Devices and media at end of life are sanitised or destroyed and recorded in the equipment disposal and reuse record (`isms/equipment-disposal-reuse-record`, DOC-ISMS-057), with the method chosen according to NIST SP 800-88 Rev. 2. ## 9. Unlabelled, mislabelled and relabelled information | Situation | Rule | |---|---| | Unlabelled electronic information | Treated as Internal (C1) until labelled, unless a detector finds personal data, which raises it to Confidential (C2) | | Information that seems under-labelled | Recipient raises the label or tells the information owner; the owner confirms within [5 working days] | | Information that seems over-labelled | Recipient asks the information owner; the label stays until the owner decides | | Planned downgrade (for example publication) | Information owner approves; the reason and date are logged; Public release follows the publication approval process | | Time-based downgrade | Label may carry a review date, for example a results announcement that becomes Public at release | | Legacy archives | Scanned and labelled in a planned project; until then access is limited to the archive owner group | ## 10. Information received from third parties | External label or scheme | Internal level | Notes | |---|---|---| | Customer "Confidential" or "Strictly Confidential" | Confidential (C2) or Restricted (C3) as stated in the contract | Contract terms override the default mapping | | TLP:CLEAR (TLP 2.0, FIRST) | Public (C0) | May be shared freely, subject to copyright | | TLP:GREEN | Internal (C1) | Within the community, not published | | TLP:AMBER | Confidential (C2) | Need to know within the organisation and its clients as the source allows | | TLP:AMBER+STRICT | Confidential (C2), organisation only | No sharing with clients | | TLP:RED | Restricted (C3), named recipients only | No further sharing | | Government or regulator markings | As agreed with the authority | Record handling instructions in the authority contacts list (`isms/authority-special-interest-contacts`) | The original label is kept as an `EXT-` sub-label. When the third party's rule is stricter than the mapped internal rule, the stricter rule applies. ## 11. Handling breaches and incidents - Report any handling breach immediately through the security event reporting procedure (`isms/security-event-reporting-procedure`, DOC-ISMS-023). Examples: Confidential or Restricted information sent to the wrong recipient, uploaded to an unapproved service, printed and lost, or left unattended. - The security team assesses whether the event is an incident under the incident response plan (`compliance/incident-response-plan`, DOC-ISMS-020) and whether personal data breach rules apply (`compliance/personal-data-breach-assessment`). - Recall, deletion requests or link revocation are attempted at once where the tool allows. - Deliberate or repeated breaches are handled through the disciplinary process (`isms/security-disciplinary-process`, DOC-ISMS-052); honest mistakes reported promptly are treated as learning opportunities. ## 12. Training and awareness - All staff complete labelling training at onboarding and at each annual awareness cycle (`security/security-awareness-program`), with examples from their own work: a customer list, a board pack, a support ticket export. - Information owners and site owners receive extra guidance on approval of downgrades and external sharing. - A one-page summary of section 5 is published on the intranet and linked from the label selection dialog where the tool allows. - Completion is recorded in the competence and training matrix (`isms/isms-competence-training-matrix`, DOC-ISMS-026). ## 13. Size tiers | Topic | Small: Quillmere Analytics Ltd (46 staff) | Medium: Quillmere Health Systems (320 staff) | Large or multi-site: Quillmere Group (2,400 staff, 6 sites) | |---|---|---|---| | Labels | Four labels in the productivity suite, default Internal, manual labelling with recommended labels for customer data exports | Mandatory labelling for documents and e-mail, automatic Restricted label for health identifiers (LBL-AUTO-002) | Group label set in all tenants, translated label descriptions for 4 countries, same codes everywhere | | Data platforms | Customer data store tagged at system level in the asset inventory | Column tags in the data catalogue for clinical scheduling data | Catalogue tags across IT data platforms; OT historian data labelled at system level per plant | | Paper and media | Little paper; one locked bin at the office; USB blocked | Locked bins at both offices; media register at the colocation suite | Site records managers at each of the 6 sites; destruction contracts per country | | Third-party labels | Customer contract terms mapped in the customer register | TLP mapping used for sector threat sharing | TLP plus authority markings at the data centre and plants | | Ownership | ISMS manager (0.5 FTE) maintains the procedure and reviews downgrade logs monthly | 3-person security team runs discovery scans and DLP triage | Security office runs a labelling service; site coordinators handle local paper and media | ## 14. Records and evidence | Record | Proves | Owner | Location | Retention | |---|---|---|---|---| | Approved procedure and revision history | Labelling rules defined (A.5.13) | ISMS manager | Documented information register (DOC-ISMS-028) | Current plus [3] previous versions | | Label configuration export | Tool settings match section 6 | IT | Productivity suite admin export | Each change plus [3 years] | | Label usage and downgrade logs | Labels applied; downgrades justified | Security team | Audit log platform | At least [1 year] | | Discovery scan reports and remediation | Unlabelled content found and fixed | Security team, information owners | DLP or discovery tool | [3 years] | | DLP alert triage records | Handling rules enforced (A.8.12) | Security team | DLP tool, ticketing | [3 years] | | Certificates of destruction and disposal records | Secure destruction (A.7.10, A.7.14) | Records or office manager | DOC-ISMS-057 | [6 years] or per records schedule | | Restricted media and print logs | Restricted physical handling | Holders, records manager | Register | [3 years] | | Training completion | Staff know the rules (A.6.3) | HR or ISMS manager | DOC-ISMS-026 | [3 years] | | Handling breach reports | Breaches reported and handled | Security team | Incident register (DOC-ISMS-021) | Per incident register retention | ## 15. References | Reference | Edition | Use | |---|---|---| | ISO/IEC 27001:2022 + Amd 1:2024 | 2022, Amd 1 published 2024-02-23 | Annex A A.5.10, A.5.12 to A.5.14, A.7.10, A.7.14, A.8.12 (cited by number) | | ISO/IEC 27002:2022 | 2022 | Guidance for classification, labelling and transfer controls | | NIST SP 800-88 Rev. 2, Guidelines for Media Sanitization | Final, September 2025 | Choice of sanitisation method in sections 5.3 and 8 | | FIRST Traffic Light Protocol (TLP) version 2.0 | Authoritative from August 2022 | External label mapping in section 10 | | ISO/IEC 27001 official page | https://www.iso.org/standard/82875.html | Purchase the standard | | ISO/IEC 27002 official page | https://www.iso.org/standard/75652.html | Control guidance | Related templates: `data/data-classification-policy`, `isms/information-transfer-policy` (DOC-ISMS-043), `isms/data-masking-dlp-standard` (DOC-ISMS-062), `isms/clear-desk-clear-screen-policy` (DOC-ISMS-056), `isms/equipment-disposal-reuse-record` (DOC-ISMS-057), `compliance/asset-inventory` (DOC-ISMS-012), `compliance/acceptable-use-policy` (DOC-ISMS-040), `data/data-retention-deletion-standard`, `isms/control-evidence-matrix` (DOC-ISMS-033). ## Standard and licence note Structure aligned with ISO/IEC 27001:2022 + Amd 1:2024, Annex A controls A.5.12 to A.5.14 with A.5.10, A.7.10 and A.8.12, and with the guidance in ISO/IEC 27002:2022. The procedure text, label texts, rule IDs, examples and guidance are original wording; ISO/IEC text is not reproduced, and the short control labels are descriptions written for this library, not official titles. ISO and IEC standards are copyrighted: obtain the official standards from ISO (https://www.iso.org/standard/82875.html) or your national standards body. TLP label names are used as published by FIRST; sanitisation references point to NIST SP 800-88 Rev. 2. Check the current editions of all referenced standards before use. Template licence: MIT.