How to Implement ISO 27001 Annex A 5.13 Information Labelling

The ultimate how to implement guide to ISO 27001 Annex A 5.13 Information Labelling.

1. Translate Classification Policy into Technical Labels

Control Requirement: An appropriate set of procedures for information labelling must be developed and implemented in accordance with the information classification scheme.

Required Implementation Step: Open your labelling platform configuration (e.g., Microsoft Purview Compliance Portal or Titus). Create specific Sensitivity Labels that map 1:1 to your policy levels (e.g., “Public”, “Internal”, “Confidential”, “Strictly Confidential”). Assign a unique colour code and tool-tip description to each label to guide users at the point of creation.

Minimum Requirement: Labels defined in the policy must exist as selectable buttons in the end-user’s Office ribbon.

2. Enforce Visual Watermarking for Sensitive Data

Control Requirement: Labels must be visually displayed on information output.

Required Implementation Step: Configure the label policy to automatically apply content markings.  For “Confidential” and above, force a diagonal watermark stating “CONFIDENTIAL – INTERNAL USE ONLY” and add a footer variable `$LabelName` to all Word documents and PowerPoint slides. This ensures that if a document is printed or screenshotted, the classification is undeniable.

Minimum Requirement: A printed page of a confidential document must physically display the classification label.

3. Embed Metadata for Automated Handling

Control Requirement: Labelling must support automation and machine processing.

Required Implementation Step: Ensure your labelling tool writes the classification into the file metadata (Custom Document Properties in Office files, XMP in PDFs). Verify this by opening a labelled file in a text editor or using `exiftool` to see the clear-text tag (e.g., `MSIP_Label_GUID`). This metadata is crucial for DLP gateways to recognise and block files later.

Minimum Requirement: The classification persists even if the file is renamed or moved to a different folder.

4. Configure Email Subject Line Tagging

Control Requirement: Email messages must be clearly labelled to warn recipients.

Required Implementation Step: Set up Exchange Transport Rules or client-side enforcement. When a user selects “Confidential”, the system must prepend `[SEC=CONFIDENTIAL]` or similar text to the email Subject Line. This provides an immediate visual cue to the recipient on mobile devices where headers might be hidden.

Minimum Requirement: External recipients can identify the data classification solely by reading the subject line.

5. Physically Label Removable Media

Control Requirement: Physical storage media containing information must be externally labelled.

Required Implementation Step: Purchase a stock of high-durability, colour-coded acetate stickers. Mandate that any USB drive, backup tape, or external hard drive receives a physical sticker matching the highest classification of data stored on it. Conduct a physical walk-around audit to peel off any unlabelled sticks found on desks.

Minimum Requirement: No plain black USB drives are permitted; every drive must carry a classification tag.

6. Implement Container-Level Labelling

Control Requirement: Systems and storage repositories should be labelled to indicate the sensitivity of stored data.

Required Implementation Step: Apply sensitivity labels to Microsoft Teams, SharePoint Sites, and AWS S3 buckets. Configure the system so that a “Confidential” Team automatically restricts guest access and prevents unmanaged devices from syncing files, inheriting the label’s security controls down to all files within that container.

Minimum Requirement: You cannot upload a “Secret” file into a “Public” SharePoint site without a warning or block.

7. Automate Default Labelling

Control Requirement: Reduce human error by ensuring a baseline label is always applied.

Required Implementation Step: Configure the global policy to set a “Default Label” (usually “Internal”) for all new documents and emails. This ensures that users must actively make a decision to downgrade data to “Public” or upgrade it to “Confidential”, preventing data from existing in an unlabelled “limbo” state.

Minimum Requirement: It is technically impossible to save a new Word document without a classification label attached.

8. Define Labelling for Data Transfer

Control Requirement: Labels must be understandable when information is shared with external parties.

Required Implementation Step: Create a “Label Mapping” table in your Data Sharing Agreements. Explicitly state that your “Strictly Confidential” is equivalent to the partner’s “Tier 1 Secret”. Where technical federation exists, map the GUIDs of your Azure AD labels to the partner’s tenant so the protection (encryption/watermarks) survives the transfer.

Minimum Requirement: Contracts explicitly define how the recipient must treat labelled data received from you.

9. Establish Mandatory Justification for Downgrading

Control Requirement: Changes to labels, especially lowering classification, must be controlled.

Required Implementation Step: Enable the “Require Justification” setting in your labelling client. If a user attempts to change a document from “Confidential” to “Public”, a pop-up must force them to type a reason. These justifications must be logged to a SIEM (e.g., Sentinel) and reviewed by the Data Privacy Officer.

Minimum Requirement: Users cannot remove a “Confidential” label silently; an audit trail of the decision is mandatory.

10. Deploy On-Screen Screen Saver Classification

Control Requirement: Information processing facilities should be labelled.

Required Implementation Step: Use Group Policy (GPO) or MDM profiles to push a standard desktop background or lock screen to specific high-security terminals (e.g., HR, Finance) that clearly displays text like “RESTRICTED SYSTEM – AUTHORISED PERSONNEL ONLY”.

Minimum Requirement: A glance at the screen immediately informs an observer that the system processes sensitive data.

About the author