Classification is just a label that tells people how carefully to handle something. This guidance explains the three levels, how to mark information, and what each level means for storing, sharing and getting rid of it.

Effective Guidance Documents

This guidance document is supplied in fully editable MS Word format and can be easily customised and edited. The document uses pre-defined style formatting throughout, with all text in Calibri font for improved readability.
The following document labelling is included in the footer:

• Guidance number and title
• Information-classification
• Version
• Page number / total pages

alphaZ documents - beautifully designed, tried and tested guidance documents. No junk, jargon or unnecessary content. Simple and usable guidance documents developed over 25 years through practical use in the real world.

Further Reading

Further guidance on information security:

• Information Classification and Protection
• Managing Information Security Risks
• Information Security Awareness and Training
• Information Security knowledge base

How to Download

This guidance document is supplied with the TT-8-07 Information Classification and Protection training talk - click through to that page to purchase. If you have an alphaZ Subscription just click on Download Files on the training talk page. The guidance is also included in the GDPR / Data Protection Toolkit, and the training talk is included in the ISO 27001 and ISO 22301 toolkits.

Need Help Implementing?

If you'd like hands-on help classifying and protecting your information assets, our remote support services provide direct expert input from our team, by the day, by project, or on an ongoing basis.

Information Classification and Protection Guidance

General guidance on classifying and handling information assets so they stay secure and have the right protection in place, using the Confidential, Business Use and Public classification levels found on alphaZ documents.

Topics Covered

• Why information is classified, and what counts as an information asset
• The classification levels, and marking information
• Handling information by classification - Confidential, Business Use and Public
• Personal data - how it is classified and protected
• AI tools - which classification levels may be entered into AI tools, and why AI output keeps the classification of its source
• Reviewing a classification, and disposal
• What to do if information is handled at the wrong classification
• Further advice, with references to the related documents

Who Is It For?

All staff who create, store or share information, and anyone maintaining an information assets register.

Included in the GDPR / Data Protection Toolkit

This guidance document is part of the GDPR / Data Protection Toolkit - the registers, forms, policies, procedure and guidance for documenting how you collect and process personal data, in one download.

Works with the Information Assets Register

The classification of each asset is recorded on the F-IMS25 Information Assets Register.

Using the Guidance

Issue the guidance to staff alongside the information assets register, so everyone understands the labels on documents and what each one means for how the information is stored, shared and disposed of.

Classification on alphaZ Documents

alphaZ documents carry an information classification in the footer, and forms holding personal data are usually marked Confidential. The guidance explains what that marking asks of the person handling the document.

Adapting the Guidance

The guidance is fully editable, so add your own storage locations and disposal arrangements for each classification level.

Related Documents

Other documents in the GDPR / Data Protection Toolkit that work alongside this one:

• F-IMS25 Information Assets Register
• GG-8-01 Information Security - General
• GG-8-06 Information Transfer