This policy procedure sets out how documents are labelled Confidential, Business Use or Public, and how each classification is stored, shared and protected.
This policy template is supplied in fully editable MS Word format and can be easily customised and edited. The document uses pre-defined style formatting throughout, with all text in Calibri font for improved readability.
The following document labelling is included in the footer:
- Policy number and title
- Information-classification
- Version
- Page number / total pages
alphaZ documents - beautifully designed, tried and tested policy templates. No junk, jargon or unnecessary content. Simple and usable policy templates
developed over 25 years through practical use in the real world.
Further guidance on information classification:
Download this policy with your company name and logo already added!
Document Preparation available with all document toolkits.
To get access to this file please click on Add to Cart to purchase for immediate download. If you have an alphaZ Subscription just click on Download Files to view all the files available to download.
If you'd like hands-on help setting up information classification and document labelling, our remote support services provide direct expert input from our team, by the day, by project, or on an ongoing basis.
Information Classification and Protection Policy Procedure Template
The Information Classification and Protection Policy Procedure is a Word template that sets out how a business classifies the information it uses and how that information is protected. It covers classification risks, a labelling system for files and documents, the default for unmarked documents, and a table of Confidential, Business Use and Public classifications with their protection and storage rules.
It applies to all employees and company activities, with disciplinary action for breaches. The file carries its own Business Use classification in the footer, alongside Title, File Location, Issue No, Issue Date, Controlled By and Approved By fields and an Amendment Record.
What the Policy Covers
- Amendment record, summary, scope and applicability - the purpose of classifying and protecting information, the activities and staff covered, and disciplinary action for breaches
- Management of classification risks - periodic risk assessments of information classification and protection, with findings actioned and the policy kept in line with current controls
- Labelling of files and documents - classification marked in the content, header, footer or filename, and the default applied where a document carries no marking
- Confidential information - secure storage with restricted access, encryption on mobile devices and external media, and no transfer or email without added security
- Business Use and Public information - the default level stored with restricted network access and shared on need, and public material that can be shared openly
Built for Clear Information Labelling
- Classification shown in the document content, header, footer or electronic filename
- Business Use set as the default for documents without confidential, personal or secret information
- Confidential files never held on portable drives or memory sticks that are not encrypted
- Confidential documents controlled in line with clear desk and clear screen arrangements
Who Needs an Information Classification and Protection Policy Procedure?
Any business that handles confidential or personal information alongside everyday business documents, and wants staff to know how each should be stored and shared.
Using the Policy
Rename the classification levels and adjust the storage and protection rules in the table to suit your own systems, and name the person in the Controlled By field. Give it top level approval and brief staff on how to mark and handle documents.
Related Documents
GG-8-07 Information Classification and Protection Guidance and TT-8-07 Information Classification and Protection Training Talk help managers and staff apply the classification levels in practice.
When a Document Has No Marking
Where a document carries no classification, the policy says the default classification should be assumed or the right classification applied based on the content. Business Use is the default level, covering company documents that hold no confidential, personal or secret information.
Classification and Data Protection
Personal data covered by data protection rules falls within the Confidential classification, so it is stored securely in locations limited to people with a legitimate need, and encrypted and password protected when held on mobile devices or other media. The policy also reminds all workers to be aware of data protection procedures and policies, such as the PP-1-16 Data Protection Policy Procedure.
Would you rather we prepared it for you?
A day of remote support can build your information security risk register around your actual systems - your risks scored with a named owner, the treatment decided for each one and the Annex A controls that apply - so the controls your staff are briefed on are the ones you have chosen.
Information Security Risk and Treatment Plan