ISO 27001:2022 · Organizational controls
ISO 27001:2022 5.13: Labelling of information
ISO 27001:2022 5.13 covers Labelling of information. The held text names 5 evidence records for it, the first being Statement of Applicability entry for control A.5.13, showing inclusion or justified exclusion, implementation status and the risks it.... The common gap an assessor flags is Labels exist on documents but not in metadata, so DLP and other systems cannot....
Procedures for labelling information are to be developed and put into effect in line with the classification scheme the organization has adopted. Purpose (stated in ISO/IEC 27002:2022): communicates information classification and supports automated processing and management of information. As an Annex A reference control, it is compared with the controls determined in risk treatment (6.1.3 c) and recorded in the Statement of Applicability as included or excluded, with the justification and implementation status (6.1.3 d); implementation guidance is ISO/IEC 27002:2022 5.13.
What evidence supports 5.13?
- Annex A organizational controlStatement of Applicability entry for control A.5.13, showing inclusion or justified exclusion, implementation status and the risks it treats
- Annex A organizational controlLabelling procedures covering all formats, with rules on placement, exemptions and cases where labelling is not possible
- Annex A organizational controlExamples of labelled documents, emails, reports and media showing the chosen techniques such as headers, watermarks or metadata
- Annex A organizational controlConfiguration of labelling or data classification tooling that applies metadata and enforces handling decisions
- Annex A organizational controlEvidence that sensitive system outputs such as reports and exports carry classification labels
Where this requirement comes from
This is our own statement of ISO 27001:2022 5.13, read from the copy we hold (licensed complete copy) and stated in our words, not the standard verbatim. The framework as we hold it.
Common gaps an assessor flags
- Labels exist on documents but not in metadata, so DLP and other systems cannot act on them
- Reports and data exports from business systems carry no label
- Labelling rules for physical media and paper are missing
- Users are never trained, so labels are applied inconsistently or not at all
How it maps to SOC 2
- C1.1 high Labelling makes classification actionable during handling.
A link is a topical overlap with a confidence and a reason. It does not establish that meeting one requirement satisfies the other, and it is not certification.