ISO 27001:2022 Annex A 5.13 labelling of information, automated

The auditor opens a shared drive, picks five files at random and asks how anyone would know which one is confidential. Your classification policy says every document is labelled. The files say otherwise.

This guide covers ISO 27001:2022 Annex A 5.13 labelling of information for UK security and compliance leads. It explains what the control requires, how one default rule and one taxonomy configured once replace manual stamping, and which evidence survives a sample.

What is ISO 27001 Annex A 5.13 and what does it cover?

ISO 27001:2022 control 5.13 labelling of information is a preventive organizational control that requires written procedures for putting the classification grade onto information itself. It sits wholly downstream of A.5.12, supports confidentiality, integrity and availability, and applies to files, email and physical media alike, so people and systems apply the right handling.

Think of the control as the visible end of a chain. A.5.12 decides the tiers, A.5.13 stamps the tier onto the information, and handling rules then act on what they see. Three neighbours matter:

• A.5.12 classification defines the scheme that labelling makes visible. Start labelling before the tiers are agreed and you will do the work twice.
• A.5.10 acceptable use sets the handling rules: what a person or system must do with each tier once the label is read.
• A.5.9 inventory is the register where labelled assets are recorded.

The mountain is smaller than it looks. A header on a board paper and a tag on a sensitive email are habits most 50-person firms already want. The 2022 guidance also reaches the digital layer, where the tag becomes something software can read.

Unlabelled data defeats people and systems at once. Staff guess what is safe to forward, and the expensive mistakes are always the confident guesses. For a regulated firm, the mark also tells clients and supervisors how to treat what you send them, which is why information-sharing agreements increasingly ask about labelling practice. It is also one of the cheapest controls to show in a sales-led security review, because a correctly tagged estate is visible in minutes.

What does ISO 27001 labelling of information require?

ISO 27001 labelling of information requires documented procedures that say which mark goes where and how it is applied, across every format the firm uses. The procedures must allow sensible exceptions, cover cases where marking is technically impossible, and be taught to staff, because a convention nobody knows about protects nothing.

A short procedure covers five things:

1. What mark. The grade names, matching the tiers in the classification scheme word for word.
2. Where it goes. A header or footer on documents, a tag in the subject line of sensitive email, a sticker on media.
3. How it is applied. A pre-marked template, a suite label or a manual step, stated per format.
4. Which exceptions are allowed. For example, deliberately leaving low-sensitivity material unmarked.
5. What happens when marking is impossible. A fallback handling rule and a record of the decision.

At around 50 people, skip the standalone labelling policy. A section inside the classification policy is enough, provided the procedure is written somewhere findable. Cover every format you use: documents, email, slide decks, spreadsheets, paper and drives.

Staff need to be shown how. Ten minutes of training plus good templates beats an hour of slides, because people learn labelling by using artefacts that arrive already marked. The failure pattern is familiar: one team applies the convention faithfully while the next never hears of it.

A convention launched by email and never trained is a rumour, not a control.

Why does A.5.13 need both visual marks and machine-readable metadata?

A.5.13 serves two audiences. People need recognisable marks (headers, footers, watermarks, stamps) to know what is safe to forward. Systems need machine-readable metadata, because data-loss-prevention tools, mail gateways and sharing controls act on tags. Visual marks with no metadata behind them leave the automated layer switched off.

The human layer works best when it is standardised and costs the author nothing: the same header wording and subject-line tag everywhere, applied by a pre-marked template rather than typed. Colour or an icon can help on paper and slides, provided the tier name is always spelled out as well.

The machine layer is metadata written into the file. Suite-native sensitivity labels apply the visible mark and the tag in one action, and the tag stays inside the file when it is shared. That persistence is why metadata matters more than the stamp: search, sorting and automated enforcement all run on it. Tags also let you find every top-tier file when a client asks where their data lives or an incident needs scoping.

The common failure is a footer typed by hand. It looks right to the reader, but no property is written to the file, so the gateway rule has nothing to read and the file leaves unchallenged. The fix is to let the label apply the footer, so mark and tag cannot drift apart.

How do you prevent label fatigue and document exceptions where marking is impossible?

Set one default rule: anything unmarked is treated as Internal, and only the upper tiers carry an explicit mark. That removes most of the workload and defeats label fatigue. Where marking genuinely cannot be applied, a short log of approved exceptions shows the auditor a documented decision rather than an omission.

The rule has respectable precedent. The UK Cabinet Office Government Security Classifications Policy says all government information should be clearly marked. It then accepts that in a wide variety of operational settings, marking OFFICIAL information would be inappropriate or not possible, and lets local policy override the rule for that tier. A written default is the same pragmatism applied to a commercial firm.

Requiring a stamp on every meeting note is how labelling schemes die.

Put the default at the top of the procedure, so an unmarked file reads as a decision and not a lapse. Staff then spend their attention on the few labels that change how a file may travel.

For genuine impossibility, keep the exception log short. Each entry needs:

• The asset or system where marking cannot be applied, such as a machine-generated export or a format with no place for a header.
• The reason, in one line.
• The compensating handling rule, for example restricted storage or encryption at rest.
• The approver and the date.
• A review date, so exceptions do not become permanent by neglect.

Label fatigue has a mirror image. Slide decks, org charts, HR spreadsheets and even the ISMS documents sit unmarked while the policy claims universal labelling. The default rule closes that gap by making the policy describe what actually happens.

How should you label physical media and removable storage?

Put a sticker or tag on every drive, tape and boxed archive, carrying the classification tier and any destruction instructions. Physical media sits outside the suite's sensitivity labels, so the mark is the only handling signal it has. Inspection records or photos then prove the convention is applied.

A scheme built around the productivity suite tends to forget the cabinet. Backup drives, tapes, USB sticks and archive boxes hold information at the same tiers as the shared drive. Nothing in Microsoft 365 or Google Workspace will mark them for you. The auditor's question is blunt: how do you mark a backup drive or an archive box?

The destruction instruction is the line people omit and the one that pays off at disposal. A tag that says "Confidential, shred on retirement" removes the decision from whoever clears the store room in three years' time.

For evidence, fold a marking check into a physical-security or asset round you already run. Record the date, note what was inspected, and keep a photo of a marked drive and a marked box. We recommend this over a new ritual, because a check attached to an existing routine actually happens.

How do you bind sensitivity labels to automated enforcement?

Define the tier set once as sensitivity labels in your productivity suite, then attach encryption, external-sharing blocks and gateway rules to the label rather than the person. Because the tag persists inside the file, protection follows it wherever it is shared, and every rule that fires leaves a logged event.

The NIST NCCoE Data Classification Practices guide, currently an initial public draft, gives the reason to bother. Discovering, identifying and labelling unstructured data lets an organisation know its data and apply technology that reduces the risk of valuable or sensitive data being lost or mismanaged. The Microsoft Learn Data Classification and Sensitivity Label Taxonomy page adds the caveat. Classification levels by themselves are simply tags, and protecting content means defining the controls that apply at each level.

A label that triggers no rule is decoration.

The build has five parts, and most of it is configuration rather than project work:

1. Define the taxonomy once. Set the tiers as sensitivity labels in Microsoft Purview or the Workspace equivalent, with a default applied so every new file is born with the scheme.
2. Auto-label known patterns. Client identifiers, payment data and personal records get tagged without waiting for a human.
3. Bind enforcement to the tag. Encryption, external-sharing blocks and gateway rules attach to the label, so protection follows the file.
4. Keep the telemetry. Each rule that fires is a logged event and becomes audit evidence.
5. Report coverage. A scheduled query for untagged content in repositories meant to hold only graded material turns a marking gap into a routine exception list.

Test persistence before you rely on it. Share a labelled file with an outside address, open it from the other side and record what survived: the tag, the encryption, the restrictions. Behaviour differs by suite, file type and recipient, so the test result is itself good evidence.

None of this obliges you to buy a product. The control asks for procedures, and the suite you already pay for often carries the labelling features, so check what your current plan includes first. At 50 people the build takes days, and afterwards the audit trail for "labels drive handling" accumulates by itself.

How do you keep labels proportionate as information ages?

Revisit marks as content ages and downgrade whatever no longer warrants its tier; otherwise the sensitive population inflates until nobody respects it. Proportion cuts both ways: label to inform handling, not to signpost value, because loud markings on crown-jewel assets tell an intruder which files are worth stealing.

Pick review triggers that match how your information really ages:

• A deal, project or engagement closes.
• An embargo lifts, for instance when results are published.
• A contract ends and the data owner confirms what must be retained.
• A periodic review of the top tier finds items nobody can justify.

The same scheduled-query approach produces the worklist. A list of top-tier items by age gives each data owner a short set of files to downgrade or confirm. Downgrading is a decision by the information's owner, so record who made it.

Tier inflation has a cost beyond tidiness. When half the estate is Confidential, staff stop reading the label, and the rules bound to it block legitimate work until people route around them.

The opposite error is advertising. Mark for handling, with metadata and a restrained header, and let access control and encryption do the protecting. The label should instruct the system and the legitimate reader without shouting at everyone else.

What evidence proves ISO 27001:2022 Annex A 5.13 labelling of information works?

Auditors want the labelling procedure, marked templates with real sampled documents and emails, the sensitivity-label configuration matching the tier scheme, enforcement logs, media inspection records, the exception log and awareness records. At this scale, configuration screenshots plus a clean sample beat a long procedure document.

The set splits into design adequacy and operational effectiveness. Design shows the scheme is sound on paper:

• The procedure, standalone or as a section of the classification policy.
• Marked templates.
• The label configuration, with the tag set matching the tier names exactly.

Operation shows it works in practice:

• Real documents and emails carrying the marks.
• Enforcement logs: gateway blocks, sharing denials, encryption events triggered by tags.
• Inspection records or photos of marked media and physical files.
• The exception log for waived marking.
• Awareness records showing staff were shown the convention.

Design evidence is quick to assemble; the operating set is what the sample tests. Pull your own sample a few weeks before the audit, fix what it finds, and keep dated screenshots of the label configuration alongside it.

What will an auditor ask about labelling, and how is it graded?

Expect spot checks: how would I know this document is confidential by looking at it, which rules fire on those tags, and where the unmarked-material decision is written down. Auditors sample random files and compare tags to tier names. A paper-only scheme grades major; an unmarked sampled document grades minor, aggregating to major as a pattern.

The questions to prepare for are:

• "How would I know this document is confidential just by looking at it?"
• "Show me your label set-up, and which rules actually fire on those tags."
• "What happens if someone emails a top-tier file to an outside address?"
• "Which material does not need marking, and where is that decision written down?"
• "How do you mark a backup drive or an archive box?"

Sampling covers real files, emails and slide decks pulled at random and checked for marks. The auditor compares the tag configuration with your stated tier names and asks a member of staff what a given label obliges them to do.

Grading follows certification-body practice rather than the text of the standard. A tag set that has drifted from the tier names is a minor finding, and a pattern of minors can aggregate to a major. With the pipeline in place, the spot check becomes a routine exception report you have already read.

Frequently asked questions