ISO-27001-Annex : A.8.2.2-Labeling-of-Information

ISO 27001 Annex : A.8.2.2 Labeling of Information & A.8.2.3 Handling of Assets

ISO 27001 Annex : A.8.2.2 Labeling of Information & A.8.2.3 Handling of Assets is based on ISO in this article these two topic has been explained.

A.8.2.2 Labeling of Information

Control- A.8.2.2 Labeling of Information In accordance with the information classification scheme adopted by the organization an adequate set of methods for labeling information should be established and implemented.

Implementation Guidance- Information labeling procedures need to cover information in physical and electronic formats and its related assets. The labeling will represent A.8.2.1 defined classification scheme. The labels are to be clearly identifiable. The protocols will provide instructions on where and how labels are applied taking into account whether the information is obtained or the assets are managed based on media forms. The procedures that identify situations where labeling is absent, e.g. non-confidential information labeling to scale back workloads. Employees and contractors should be made aware of the procedures for labeling.
An appropriate classification label should be included in the output from the system containing information classified as sensitive or critical.

Other Information- Classified information labeling is an essential prerequisite for agreements for information sharing. The common labeling form is physical labels and metadata.
Information labeling and associated assets can sometimes be detrimental. Subject to classified assets, insider assets or external attackers are easier to identify and steal.

At Infosavvy we have our trainers who are skilled and well-trained in various courses in the field of information security and we are also eligible for one of the most important certificates in the area of information security. i.e. IRCA CQI ISO 27001:2013 Lead Auditor (LA) and ISO 27001 Lead Implementer (LI) (TÜV SÜD Certification) . Our trainers can empower you to do better labeling of information by providing you with in-depth information and numerous examples for the same, helping the applicant to improve their skills and do well. Through a combination of tutorials, syndicate exercises and role-play, you will learn everything you need to know about how an ISMS audit should be run including conducting second and third-party audits.

Related Product : ISO 27001 Lead Auditor Training And Certification ISMS

A.8.2.3 Handling of Assets

Control- A.8.2.3 Handling of Assets Procedures for the handling of assets in accordance with the organization ‘s information classification scheme should be developed and implemented.

Implementation Guidance- Procedures should be developed for the handling, processing, storing, and communication of classified information.

The following points should be taken into consideration:-

Access restrictions that support the security standards for each classification level;

 Maintaining a formal record of the approved recipients of the assets;

Security to a level consistent with the security of the original information for temporary or permanent copies of information;

 IT asset storage as specified by the manufacturer;

 Clear marking for the authorized recipient of all copies of the media.

The scheme for classification used in the organization, even if the classification levels are similar, may not equate to the schemes employed by other organizations; in addition, information moving across organizations can vary according to their contexts, even if their classification schemes are equal.
Accords with other organizations that include sharing information should include methods of classifying that information and interpreting other organizations’ classifications labels.

Also Read : ISO 27001 Annex : A.8.2 Information Classification

Questions related to this topic
  1. What are the levels of confidentiality?
  2. What should be included in an asset management policy?
  3. Who is responsible for classifying information in TCS?
  4. How do you classify information assets?
  5. Explain ISO 27001 Annex : A.8.2.2 Labeling of Information & A.8.2.3 Handling of Assets?

ISO 27001 Requirements

Clause 4.2 Understanding the needs and expectations of interested parties 
Clause 4.4 Information security management system
Clause 4.3 Determining the scope of the information security management system
Clause 5.1 Leadership and commitment
Clause 5.2 Policy
Clause 5.3 Organizational roles, responsibilities and authorities 
Clause 6.1 Actions to address risks and opportunities
Clause 6.1.2 Information security risk assessment process
Clause 6.1.3 Information security risk treatment
Clause 6.2 Information security objectives & planning
Clause 7.1 Resources
Clause 7.2 Competence
Clause 7.3 Awareness
Clause 7.4 Communication
Clause 7.5 Documented information Implementation Guideline
Clause 8.1 Operational planning & control
Clause 8.2 Information security risk assessment
Clause 8.3 Information security risk treatment
Clause 9.1 Performance evaluation Monitoring, measurement, analysis & evaluation
Clause 9.2 Internal audit
Clause 9.3 Management review
Clause 10.1 Non conformity and corrective action
Clause 10.2 Continual Improvement  

ISO 27001 Annex A Controls

Annex A.5 Information Security Policies
Annex A.6 Organization of Information Security
Annex A.6.2 Mobile Devices and Teleworking
Annex A.7 Human Resource Security
Annex A.7.2 During Employment
Annex A.7.3 Termination and Change of Employment
Annex A.8 Asset Management
Annex A.8.1.3 Acceptable Use of Assets & A.8.1.4 Return of Assets
Annex A.8.2 Information Classification
Annex A.8.3 Media Handling
Annex A.9 Access Control
Annex A.9.1.2 Access to Networks and Network Services
Annex A.9.2 User Access Management
Annex A.9.2.3 Management of Privileged Access Rights  
Annex A.9.2.4 Management of Secret Authentication Information of Users
Annex A.9.2.5 Review of User Access Rights 
Annex A.9.2.6 Removal or Adjustment of Access Rights
Annex A.9.3 User Responsibilities
Annex A.9.4 System and Application Access Control
Annex A.9.4.4 Use of Privileged Utility Programs 
Annex A.9.4.5 Access Control to Program Source Code
Annex A.10 Cryptography
Annex A.11 Physical and Environmental Security
Annex A.11.2 Equipment
Annex A.11.1.3 Securing Offices, Rooms and Facilities
Annex A.11.1.4 Protecting Against External and Environmental Threats
Annex A.11.1.5 Working in Secure Areas
Annex A.11.1.6 Delivery and Loading Areas

About ISO 27002

Infosavvy, 2nd Floor, Sai Niketan, Chandavalkar Road Opp. Gora Gandhi Hotel, Above Jumbo King, beside Speakwell Institute, Borivali West, Mumbai, Maharashtra 400092

Contact us –

Leave a Comment

Your email address will not be published. Required fields are marked *