[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:iso-27001\u002Fa-5-12":3},{"item":4,"lessons":16,"controls":38,"related":53},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"iso-27001","a-5-12","Annex A 5.12","ISO\u002FIEC 27001:2022 Annex A 5.12: Classification of information",5,"International Organization for Standardization (ISO) and IEC","**What it asks for.** This control expects information to be classified according to the information security needs of the organisation, based on confidentiality, integrity, availability and relevant interested party requirements. Its purpose is to make sure the protection needs of information are understood and that each type gets an appropriate level of protection.\n\n**In practice.** Good practice is a simple classification scheme with a small number of levels, clear criteria and owners responsible for classifying their information. Classification drives handling rules for storage, sharing and disposal. Auditors look for the scheme, examples of classified information, evidence that owners apply it and links to labelling and handling controls.\n\n**Common gaps.** Common gaps are schemes too complex for staff to use, most information left unclassified and classification that does not change how information is handled. Information created in collaboration tools and AI services is frequently outside the scheme.",null,"https:\u002F\u002Fwww.iso.org\u002Fstandard\u002F27001","See the standard at ISO","2026-10-18T15:18:43.663+00:00",{"total":9,"list":17},[18,22,26,30,34],{"slug":19,"title":20,"published_at":21},"microsoft-bolsters-ai-agent-security-with-dlp-auto-labeling-and-copilot-controls","Microsoft Bolsters AI Agent Security with DLP, Auto-Labeling, and Copilot Controls","2026-09-24T20:22:23.286+00:00",{"slug":23,"title":24,"published_at":25},"italian-hospital-fined-10000-for-publishing-sensitive-recruitment-data-online","Italian Hospital Fined €10,000 for Publishing Sensitive Recruitment Data Online","2026-09-08T14:22:25.098+00:00",{"slug":27,"title":28,"published_at":29},"italian-hospital-fined-10000-for-unlawfully-publishing-sensitive-personal-data-online","Italian Hospital Fined €10,000 for Unlawfully Publishing Sensitive Personal Data Online","2026-09-08T10:22:52.793+00:00",{"slug":31,"title":32,"published_at":33},"italian-ministry-of-justice-fined-for-posting-employee-health-data-on-canteen-bulletin-board","Italian Ministry of Justice Fined for Posting Employee Health Data on Canteen Bulletin Board","2026-07-20T12:20:57.331+00:00",{"slug":35,"title":36,"published_at":37},"italian-ministry-of-justice-fined-for-publicly-exposing-employee-health-data","Italian Ministry of Justice Fined for Publicly Exposing Employee Health Data","2026-07-20T12:20:40.691+00:00",[39,44,49],{"slug":40,"name":41,"problem":42,"stories":43},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",3,{"slug":45,"name":46,"problem":47,"stories":48},"ai-security","AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",1,{"slug":50,"name":51,"problem":52,"stories":48},"zero-trust-access","Zero trust network access (ZTNA)","Remote access no longer means exposing VPN appliances to the internet.",[54,59,64,69,73,78,82,86],{"family":55,"item":56,"code":57,"title":58,"together":9},"cis","3","Control 3","Data Protection",{"family":60,"item":61,"code":62,"title":63,"together":9},"gdpr","5","Article 5(1)(f)","Principles relating to processing of personal data",{"family":55,"item":65,"code":66,"title":67,"together":68},"14","Control 14","Security Awareness and Skills Training",4,{"family":60,"item":70,"code":71,"title":72,"together":68},"9","Article 9","Processing of special categories of personal data",{"family":74,"item":75,"code":76,"title":77,"together":43},"nist-800-53","ac-3","AC-3","Access Enforcement",{"family":60,"item":79,"code":80,"title":81,"together":43},"25","Article 25","Data protection by design and by default",{"family":60,"item":83,"code":84,"title":85,"together":43},"6","Article 6","Lawfulness of processing",{"family":74,"item":87,"code":88,"title":89,"together":43},"mp-3","MP-3","Media Marking"]