What it asks for. The organisation should develop and implement procedures for labelling information that follow its classification scheme. Labels let people and systems recognise how information must be handled.
In practice. Labelling rules cover documents, emails, removable media and, where useful, system metadata. Many organisations use tooling such as sensitivity labels in office suites, which can apply visual markings and drive data loss prevention rules. The procedure explains when labels are not required, for example for public information, and how to label formats where physical marking is impractical. Evidence includes the labelling procedure, configuration of labelling tools, sample labelled assets and training content.
Common gaps. Labelling schemes are often too complex, so staff default to the lowest or highest level regardless of content. Labels are frequently applied but not connected to any technical control, which means they change nothing about how information is actually protected.