T1.3.2 - LABELING OF INFORMATION Implementation Guidance
The entity shall label information in accordance with the classification scheme adopted by the entity.
Back to T1.3.2 - P3 - LABELING OF INFORMATION
Procedures for information labeling need to cover information and its related assets in physical and electronic formats. The labeling should reflect the classification scheme established in. The labels should be easily recognizable. The procedures should give guidance where and how labels are attached in consideration of how the information is accessed or the assets are handled depending on the types of media. The procedures can define cases where labeling is omitted, e.g. labeling of non-confidential information to reduce workloads. Employees and external party users should be made aware of labeling procedures.
Output from systems containing information that is classified as being sensitive or critical should carry an appropriate classification label in the output.
