[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:iso-27001\u002Fa-5-13":3},{"item":4,"lessons":16,"controls":26,"related":31},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"iso-27001","a-5-13","Annex A 5.13","Labelling of information",2,"International Organization for Standardization (ISO) and IEC","**What it asks for.** The organisation should develop and implement procedures for labelling information that follow its classification scheme. Labels let people and systems recognise how information must be handled.\n\n**In practice.** Labelling rules cover documents, emails, removable media and, where useful, system metadata. Many organisations use tooling such as sensitivity labels in office suites, which can apply visual markings and drive data loss prevention rules. The procedure explains when labels are not required, for example for public information, and how to label formats where physical marking is impractical. Evidence includes the labelling procedure, configuration of labelling tools, sample labelled assets and training content.\n\n**Common gaps.** Labelling schemes are often too complex, so staff default to the lowest or highest level regardless of content. Labels are frequently applied but not connected to any technical control, which means they change nothing about how information is actually protected.",null,"https:\u002F\u002Fwww.iso.org\u002Fstandard\u002F27001","See the standard at ISO","2026-10-18T15:18:43.664+00:00",{"total":9,"list":17},[18,22],{"slug":19,"title":20,"published_at":21},"italian-hospital-fined-10000-for-publishing-sensitive-recruitment-data-online","Italian Hospital Fined €10,000 for Publishing Sensitive Recruitment Data Online","2026-09-08T14:22:25.098+00:00",{"slug":23,"title":24,"published_at":25},"italian-ministry-of-justice-fined-for-publicly-exposing-employee-health-data","Italian Ministry of Justice Fined for Publicly Exposing Employee Health Data","2026-07-20T12:20:40.691+00:00",[27],{"slug":28,"name":29,"problem":30,"stories":9},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[32,37,41,45,50,54,59,63],{"family":33,"item":34,"code":35,"title":36,"together":9},"cis","14","Control 14","Security Awareness and Skills Training",{"family":33,"item":38,"code":39,"title":40,"together":9},"3","Control 3","Data Protection",{"family":5,"item":42,"code":43,"title":44,"together":9},"a-5-12","Annex A 5.12","ISO\u002FIEC 27001:2022 Annex A 5.12: Classification of information",{"family":46,"item":47,"code":48,"title":49,"together":9},"nist-800-53","ac-3","AC-3","Access Enforcement",{"family":46,"item":51,"code":52,"title":53,"together":9},"mp-3","MP-3","Media Marking",{"family":55,"item":56,"code":57,"title":58,"together":9},"gdpr","5","Article 5(1)(f)","Principles relating to processing of personal data",{"family":55,"item":60,"code":61,"title":62,"together":9},"6","Article 6","Lawfulness of processing",{"family":55,"item":64,"code":65,"title":66,"together":9},"9","Article 9","Processing of special categories of personal data"]