ISO 27001 Annex : A.8.2.2 Labeling of Information & A.8.2.3 Handling of Assets

ISO 27001 Annex : A.8.2.2 Labeling of Information & A.8.2.3 Handling of Assets is based on ISO in this article these two topic has been explained.

A.8.2.2 Labeling of Information

Control- A.8.2.2 Labeling of Information In accordance with the information classification scheme adopted by the organization an adequate set of methods for labeling information should be established and implemented.

Implementation Guidance- Information labeling procedures need to cover information in physical and electronic formats and its related assets. The labeling will represent A.8.2.1 defined classification scheme. The labels are to be clearly identifiable. The protocols will provide instructions on where and how labels are applied taking into account whether the information is obtained or the assets are managed based on media forms. The procedures that identify situations where labeling is absent, e.g. non-confidential information labeling to scale back workloads. Employees and contractors should be made aware of the procedures for labeling.
An appropriate classification label should be included in the output from the system containing information classified as sensitive or critical.

Other Information- Classified information labeling is an essential prerequisite for agreements for information sharing. The common labeling form is physical labels and metadata.
Information labeling and associated assets can sometimes be detrimental. Subject to classified assets, insider assets or external attackers are easier to identify and steal.

At Infosavvy we have our trainers who are skilled and well-trained in various courses in the field of information security and we are also eligible for one of the most important certificates in the area of information security. i.e. IRCA CQI ISO 27001:2013 Lead Auditor (LA) and ISO 27001 Lead Implementer (LI) (TÜV SÜD Certification) . Our trainers can empower you to do better labeling of information by providing you with in-depth information and numerous examples for the same, helping the applicant to improve their skills and do well. Through a combination of tutorials, syndicate exercises and role-play, you will learn everything you need to know about how an ISMS audit should be run including conducting second and third-party audits.

Related Product : ISO 27001 Lead Auditor Training And Certification ISMS

A.8.2.3 Handling of Assets

Control- A.8.2.3 Handling of Assets Procedures for the handling of assets in accordance with the organization ‘s information classification scheme should be developed and implemented.

Implementation Guidance- Procedures should be developed for the handling, processing, storing, and communication of classified information.

The following points should be taken into consideration:-

– Access restrictions that support the security standards for each classification level;

– Maintaining a formal record of the approved recipients of the assets;

– Security to a level consistent with the security of the original information for temporary or permanent copies of information;

– IT asset storage as specified by the manufacturer;

– Clear marking for the authorized recipient of all copies of the media.

The scheme for classification used in the organization, even if the classification levels are similar, may not equate to the schemes employed by other organizations; in addition, information moving across organizations can vary according to their contexts, even if their classification schemes are equal.
Accords with other organizations that include sharing information should include methods of classifying that information and interpreting other organizations’ classifications labels.

Also Read : ISO 27001 Annex : A.8.2 Information Classification

Questions related to this topic

1. What are the levels of confidentiality?
2. What should be included in an asset management policy?
3. Who is responsible for classifying information in TCS?
4. How do you classify information assets?
5. What is ISO 27001 Annex : A.8.2.2 Labeling of Information & A.8.2.3 Handling of Assets?

---

This Blog Article is posted by
Infosavvy, 5B 306 Riverside Greens, Panvel, Raigad 410206 Maharashtra, India

Contact us – www.infocerts.com

https://goo.gl/maps/mHkyURHmeFXyGiVw5