Key takeaways
- Apply visible or metadata labels matching your classification scheme.
- Labels tell people at a glance how to handle information, which is what makes classification work in practice.
- Start here: decide how each level is labelled: headers, footers, metadata, file naming or system tags.
Purpose
Apply visible or metadata labels matching your classification scheme.
Requirement
Requirement summaryAn appropriate set of procedures for information labelling shall be developed and implemented in accordance with the information classification scheme adopted by the organization.
Why it matters
Labels tell people at a glance how to handle information, which is what makes classification work in practice.
How to implement
- Decide how each level is labelled: headers, footers, metadata, file naming or system tags.
- Use automatic labelling tools where your platform supports them.
- Explain what to do when information has no label.
- Spot-check documents and systems for correct labels.
What evidence you need to provide
Here is what you will typically need to provide for Annex A 5.13. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- Simple instructions on how to label information at each classification level (paper, documents, email).
- Your Statement of Applicability (SoA: the list of all 93 controls showing which you use and why) with A.5.13 marked as used or not used, a short reason, and its current status.
Records and examples to show
- Examples of labelled documents, reports or shared folders.
- Examples of labelled printed or removable media where relevant.
Things you should be able to show or explain
- Be able to show labelling in everyday use, such as a 'Confidential' footer.
How much to show: A handful of items at different levels.
Common mistakes
- Confidential documents without labels.
- Instructions don't cover digital files.
- Requiring manual labels on everything, which staff ignore.
- Labels that do not match the classification scheme.
- Tip: Use document templates and email tools that add labels automatically.
Policies & documents to have
- Data Management Policy
FAQ
Is A.5.13 mandatory?
Annex A controls are not automatically mandatory. You must consider every control and record in your Statement of Applicability whether it applies and why. In practice, most organisations include this one.
What will I need to show for A.5.13?
Be ready to explain how the control works in your organisation and to provide things like: Simple instructions on how to label information at each classification level (paper, documents, email)…