## 5.13 Labelling of information

  

**Control**
An appropriate set of procedures for information labelling should be developed and implemented in accordance with the information classification scheme adopted by the organization.

**Purpose**
To facilitate the communication of classification of information and support automation of information processing and management.

**Guidance**
Procedures for information labelling should cover information and other associated assets in all formats. The labelling should reflect the classification scheme established in 5.12. The labels should be easily recognizable. The procedures should give guidance on where and how labels are attached in consideration of how the information is accessed or the assets are handled depending on the types of storage media. The procedures can define:

a\) cases where labelling is omitted (e.g. labelling of non-confidential information to reduce workloads);

b\) how to label information sent by or stored on electronic or physical means, or any other format;

c\) how to handle cases where labelling is not possible (e.g. due to technical restrictions). Examples of labelling techniques include:

a\) physical labels;

b\) headers and footers;

c\) metadata;

d\) watermarking;

e\) rubber-stamps.

Digital information should utilize metadata in order to identify, manage and control information, especially with regard to confidentiality. Metadata should also enable efficient and correct searching for information. Metadata should facilitate systems to interact and make decisions based on the associated classification labels.

The procedures should describe how to attach metadata to information, what labels to use and how data should be handled, in line with the organization’s information model and ICT architecture.

Relevant additional metadata should be added by systems when they process information depending on its information security properties.

Personnel and other interested parties should be made aware of labelling procedures. All personnel should be provided with the necessary training to ensure that information is correctly labelled and handled accordingly.

Output from systems containing information that is classified as being sensitive or critical should carry an appropriate classification label.

**Other information**
Labelling of classified information is a key requirement for information sharing.

Other useful metadata that can be attached to the information is which organizational process created the information and at what time.

Labelling of information and other associated assets can sometimes have negative effects. Classified assets can be easier to identify by malicious actors for potential misuse.

Some systems do not label individual files or database records with their classification but protect all information at the highest level of classification of any of the information that it contains or is permitted to contain. It is usual in such systems to determine and then label information when it is exported.