What it asks for. This control expects information to be classified according to the information security needs of the organisation, based on confidentiality, integrity, availability and relevant interested party requirements. Its purpose is to make sure the protection needs of information are understood and that each type gets an appropriate level of protection.
In practice. Good practice is a simple classification scheme with a small number of levels, clear criteria and owners responsible for classifying their information. Classification drives handling rules for storage, sharing and disposal. Auditors look for the scheme, examples of classified information, evidence that owners apply it and links to labelling and handling controls.
Common gaps. Common gaps are schemes too complex for staff to use, most information left unclassified and classification that does not change how information is handled. Information created in collaboration tools and AI services is frequently outside the scheme.