What evidence does ISO 27001:2022 5.12 need?

Statement of Applicability entry for control A.5.12, showing inclusion or justified exclusion, implementation status and the risks it treats. The topic-specific classification policy with named levels, criteria based on impact, and conventions covering confidentiality, integrity and availability. Evidence the scheme was communicated to relevant interested parties and built into procedures

5.12 of ISO 27001:2022, stated here in our words and cited to that clause.

Does it map to the other framework?

Yes, to 1 criteria in the other framework, each with a confidence and a reason. A link is a topical overlap, not a legal equivalence.

ISO 27001:2022 5.12 evidence: Classification of information

ISO 27001:2022 5.12: Classification of information

ISO 27001:2022 5.12 covers Classification of information. The held text names 5 evidence records for it, the first being Statement of Applicability entry for control A.5.12, showing inclusion or justified exclusion, implementation status and the risks it.... The common gap an assessor flags is Everything is classified as confidential, so the scheme gives no useful handling signal.

Information is to be classified according to the organization's security needs, judged on confidentiality, integrity, availability and the requirements of relevant interested parties. Purpose (stated in ISO/IEC 27002:2022): ensures the protection needs of information are identified and understood according to its importance. As an Annex A reference control, it is compared with the controls determined in risk treatment (6.1.3 c) and recorded in the Statement of Applicability as included or excluded, with the justification and implementation status (6.1.3 d); implementation guidance is ISO/IEC 27002:2022 5.12.

What evidence supports 5.12?

Annex A organizational controlStatement of Applicability entry for control A.5.12, showing inclusion or justified exclusion, implementation status and the risks it treats
Annex A organizational controlThe topic-specific classification policy with named levels, criteria based on impact, and conventions covering confidentiality, integrity and availability
Annex A organizational controlEvidence the scheme was communicated to relevant interested parties and built into procedures
Annex A organizational controlClassification records in the asset inventory or labels showing owner-assigned classifications
Annex A organizational controlRecords of classification reviews and reclassification when sensitivity or criticality changed

Where this requirement comes from

This is our own statement of ISO 27001:2022 5.12, read from the copy we hold (licensed complete copy) and stated in our words, not the standard verbatim. The framework as we hold it.

Common gaps an assessor flags

Everything is classified as confidential, so the scheme gives no useful handling signal
Classifications are never revisited once information is published or ages
Integrity and availability are ignored and only confidentiality is classified
Information received from partners is handled under their labels with no agreed mapping

How it maps to SOC 2

C1.1 high Classification of information is how confidential information gets identified.

A link is a topical overlap with a confidence and a reason. It does not establish that meeting one requirement satisfies the other, and it is not certification.