ISOISO 27001Annex A Controls OverviewEASYFree question
What does control A.5.12 (Classification of information) require?
- A.Labelling documents according to their age and author, with retention dates, disposal methods, and archive locations recorded in a register
- B.Classifying information according to its security needs based on confidentiality, integrity, and availability requirements
- C.Rating suppliers by contract value and criticality, with review dates, scorecards, and exit terms
- D.Sorting incidents by severity and affected asset, with response times, owners, and closure criteria
Why B is correct
A.5.12 requires information to be classified according to the organization's information security needs, considering confidentiality, integrity, and availability.
Know someone studying for ISO 27001? Send them this one.