A.5.12 Organizational
Classification of information
Structured attributes from ISO/IEC 27002:2022 — control type · CIA properties · cybersecurity concept · operational capability · security domain. What do these mean?
The implementation guidance for this control is published in
ISO/IEC 27002:2022
and is not reproduced here. The structured attributes and the cross-walk
rationales below are derived facts and our own AI-authored analysis.
Mapped NIST 800-53 r5 controls (14)
Our AI-authored reading (authority llm_unverified, under review) of how this ISO control and each NIST 800-53 control relate. Not an ISO or NIST product.
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- AC-16mostlyaligns with — Both controls establish security attributes on information that drive handling, protection, and access decisions throughout its lifecycle.
- RA-2mostlyaligns with — Both controls require organizations to evaluate the sensitivity and criticality of information to determine appropriate protection levels.
- AC-16partialcovers — A.5.12's classification process directly supplies one core permitted attribute (sensitivity level) that AC-16 can associate and retain with data objects, but leaves the bulk of AC-16's requirements (defining the full attribute set, binding mechanics for storage/process/transit, retention rules, and non-classification attributes) uncovered.
- AC-4partialaligns with — Both controls use classification attributes to enforce information flow restrictions between systems or organizations.
- CA-3partialaligns with — Both controls require agreements that define how classification levels are interpreted and handled when information is shared between organizations.
- MP-3partialaligns with — Both controls require marking of information with classification or sensitivity labels to communicate protection requirements.
- SC-16partialaligns with — Both controls require transmission of security attributes so that receiving systems can apply appropriate protections based on classification.
- AC-4covers — Assessed as NOT holding by the authoring instrument at v1.22-2026-08-29. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.
- MP-3covers — Assessed as NOT holding by the authoring instrument at v1.19-2026-08-23. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.
- SC-16covers — Assessed as NOT holding by the authoring instrument at v1.22-2026-08-29. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.
Aligned NIST CSF 2.0 outcomes (22)
NIST CSF 2.0 outcomes this ISO control aligns with — our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- ID.AM-05mostlyaligns with — Classification directly feeds asset prioritization by establishing the value, sensitivity, and criticality that determine protection levels and business impact.
- PR.AA-05mostlyaligns with — The classification scheme is explicitly required to align with the access-control policy so that entitlements and handling rules reflect the defined sensitivity levels.
- GV.OC-03partialaligns with — Legal, regulatory, and contractual confidentiality, integrity, and availability obligations are incorporated into the classification criteria and handling rules.
- GV.PO-01partialaligns with — A topic-specific classification policy is established and communicated, forming part of the broader cybersecurity risk-management policy framework.
- ID.AM-07partialaligns with — Classification results are maintained and updated throughout the information life cycle, ensuring metadata reflects current value and sensitivity.
- ID.RA-04partialaligns with — Classification levels are derived from the potential impact of compromise, directly supporting the identification and recording of impact and likelihood values.
- GV.OC-03implements — Assessed as NOT holding by the authoring instrument at v1.22-2026-08-29. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.
- GV.PO-01implements — Assessed as NOT holding by the authoring instrument at v1.19-2026-08-23. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.
- ID.AM-05implements — A.5.12's core purpose (classify information by importance/protection needs) directly supplies the classification input that ID.AM-05 explicitly uses to prioritize assets; this is operational effect within the shared asset-management domain, not by explicit citation of the CSF outcome.
- ID.AM-07implements — Assessed as NOT holding by the authoring instrument at v1.19-2026-08-23. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.
- ID.RA-04implements — Assessed as NOT holding by the authoring instrument at v1.22-2026-08-29. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.
- PR.AA-05implements — Assessed as NOT holding by the authoring instrument at v1.19-2026-08-23. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.
Related OWASP ASVS 5.0 requirements (7)
Application-security verification requirements (OWASP ASVS 5.0) this ISO control aligns with; links open the ASVS chapter. Our AI-authored analysis (authority llm_unverified, under review) — many ISO controls have no ASVS counterpart.
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- V14.1.1mostlyaligns with — The ISO requirement to classify information according to confidentiality, integrity and availability needs directly supports the ASVS mandate to identify and classify all sensitive data processed by the application into protection levels.
- V14.1.2mostlyaligns with — Establishing a classification scheme with associated protective controls aligns with the ASVS requirement that each protection level must have documented protection requirements covering encryption, integrity, retention, logging and access controls.
- V13.1.4partialaligns with — The ISO directive that owners are accountable for classification and that the scheme must address business needs for sharing or restricting information aligns with the ASVS requirement to document critical secrets and their rotation schedule.
- V14.2.4partialaligns with — Defining handling rules based on classification levels provides the foundation for the ASVS requirement that controls around sensitive data must address encryption, integrity verification, retention, logging and access control.
Related weaknesses / CWE (32)
Weakness classes this ISO control helps prevent or mitigate — our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- CWE-1230mitigates — Classification helps identify metadata that may need protection, but does not directly limit its exposure.
- CWE-1323prevents — Classification identifies trace data as sensitive, guiding its protection.
- CWE-200prevents — By requiring owners to assign sensitivity labels and corresponding handling rules, the control ensures that information is not left unmarked and therefore reduces the chance that sensitive data will be exposed to unauthorized actors.
- CWE-201mitigates — Classification identifies sensitive data so it is not inadvertently transmitted.
- CWE-202mitigates — Classification helps identify sensitive data that must be protected from inference attacks.
- CWE-212prevents — Classification identifies sensitive data that must be removed before storage or transfer.
- CWE-213prevents — Classification directly addresses mismatched sensitivity views by defining what must be protected.
- CWE-219mitigates — Classification identifies sensitive data so it can be placed outside the web root.
- CWE-284mitigates — The classification scheme is explicitly aligned with the access-control policy, so protective controls are applied consistently and the risk of improper access decisions is lowered.
- CWE-313prevents — Classification identifies sensitive data that must not be stored in cleartext.
- CWE-315prevents — Requires classification of sensitive information, indirectly driving protection measures for cookies.
- CWE-526mitigates — Classification drives decisions on what must be protected, indirectly discouraging cleartext storage of sensitive data.
- CWE-528mitigates — Classification helps identify core dumps as sensitive, but does not enforce storage or access restrictions.
- CWE-530mitigates — Classification helps identify which backups need stricter handling, but does not enforce storage location or access restrictions.
- CWE-540prevents — Classification helps identify source code containing sensitive data so it can be protected.
- CWE-552mitigates — Labeling information according to its sensitivity and specifying corresponding protection measures makes it less probable that files or directories containing sensitive content will be left accessible to external parties.
- CWE-612prevents — Classification helps identify what must be protected but does not enforce index access limits.
- CWE-732prevents — Classification results drive the assignment of permissions and handling procedures, decreasing the likelihood that critical resources receive incorrect or overly permissive permission settings.
- CWE-921mitigates — Classification identifies sensitive data that must not be stored without access controls.
Mitigated MITRE ATT&CK techniques (191)
Adversary techniques (MITRE ATT&CK Enterprise) this ISO control helps mitigate; links open attack.mitre.org. Our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
T1001←MT1001.001←MT1001.002←MT1001.003←MT1006←MT1014←MT1027.001←MT1027.002←MT1027.003←MT1027.006←MT1027.007←MT1027.008←MT1027.009←MT1027.010←MT1027.011←MT1027.013←MT1027.014←MT1027.016←MT1027.017←MT1027.018←MT1030←MT1036←MT1036.002←MT1036.003←MT1036.005←MT1036.008←MT1036.009←MT1036.011←MT1036.012←MT1040←MT1055←MT1055.001←MT1055.002←MT1055.003←MT1055.004←MT1055.005←MT1055.008←MT1055.009←MT1055.011←MT1055.012←MT1055.013←MT1055.014←MT1055.015←MT1068←MT1070←MT1070.003←MT1070.006←MT1070.010←MT1071←MT1071.001←MT1071.004←MT1074.002←MT1090.002←MT1090.003←MT1090.004←MT1095←MT1098.005←MT1102←MT1102.001←MT1110.001→MT1114.001→PT1127←MT1127.001←MT1132.001←MT1132.002←MT1134←MT1134.001←MT1134.002←MT1134.003←MT1134.004←MT1134.005←MT1137.001→PT1137.002→PT1137.004→PT1137.005→PT1137.006→PT1202←MT1204.004←MT1207←MT1211←MT1213→PT1213.001→PT1213.002→PT1213.003→PT1213.005→PT1216←MT1218←MT1218.005←MT1218.007←MT1218.008←MT1218.010←MT1218.011←MT1218.012←MT1218.013←MT1221←MT1222←MT1222.001←MT1222.002←MT1480.001←MT1484←MT1484.002←MT1490←MT1497←MT1530→PT1535←MT1537←MT1539←FT1542←MT1542.002←MT1550←MT1550.001←FT1550.002←FT1550.003←FT1550.004←FT1552.001→PT1552.004→PT1553.001←MT1553.002←PT1553.003←MT1553.004←MT1553.005←MT1553.006←MT1556←MT1556.006←PT1556.007←MT1556.009←MT1564←MT1564.001←MT1564.004←MT1565→PT1565.001→PT1568←PT1571←MT1572←MT1574←MT1574.001←MT1574.013←MT1578.001←MT1578.002←MT1578.003←MT1578.004←MT1578.005←MT1598.001→PT1599←MT1599.001←MT1600←MT1600.001←PT1601.001←PT1601.002←MT1606.001←FT1610←PT1612←MT1620←MT1621←MT1622←MT1647←PT1665←PT1666←MT1678←MT1684.002←MT1685←MT1685.002←MT1685.003←MT1685.004←MT1685.005←MT1685.006←MT1686←FT1686.003←MT1688←MT1689←PT1690←M
Why these map — AI rationale (under review)
- T1110.001prevents — A.5.12's classification scheme (with associated protective controls, access alignment, and handling procedures) directly enables stronger authentication requirements and account protections that stop password guessing from succeeding, matching the A.8.5 anchor's logic on proportionate strength; the remainder is that classification alone does not mandate specific mechanisms like MFA or lockouts.
- T1114.001prevents — A.5.12's classification scheme (with associated protective controls and owner accountability) can prevent the technique when email data is marked sensitive and routed into access-restricted storage, but the control only sets policy-level expectations and does not itself enforce the technical protections that stop local file collection.
- T1137.001prevents — A.5.12's classification scheme (with associated handling rules and owner accountability) can constrain macro-enabled templates as sensitive/persistent assets and mandate stricter controls on them, lowering the chance the technique is introduced or succeeds, but does not itself stop template abuse or macro execution.
- T1137.002prevents — A.5.12's classification scheme (with associated protective controls and access-control alignment) can constrain where and how the malicious Office Test Registry key/DLL is placed or shared, but does not stop the adversary technique itself from being used on classified assets.
- T1137.004prevents — A.5.12's classification scheme (with associated handling/protection rules and sharing agreements) can constrain whether/where a malicious Outlook Home Page URL or HTML is introduced or allowed to execute, but this is only a minority slice of the persistence technique itself.
- T1137.005prevents — A.5.12's classification policy and scheme (with handling rules aligned to access control) can constrain macro/rule execution on classified email, preventing the technique from succeeding on protected mailboxes, but this is only a slice as the control does not mandate technical enforcement or removal of the Outlook rules mechanism itself.
- T1137.006prevents — A.5.12's classification scheme (with associated protective controls and owner accountability) can constrain which add-ins are allowed or how they are handled based on information sensitivity, directly preventing some abuse vectors for persistence, but leaves many technical execution paths untouched.
- T1213prevents — A.5.12's classification scheme (with associated protective controls, owner accountability, and alignment to access-control policy) directly drives correct handling and sharing restrictions that stop most repository mining of sensitive data; partial because the control only sets the scheme and does not itself enforce the resulting access controls or fix pre-existing misconfigurations.
- T1213.001prevents — A.5.12's classification scheme (with associated protective controls and owner accountability) directly constrains what information can be stored in or shared via Confluence and how it must be protected, preventing the technique from succeeding on classified assets; it is only partial because the control is silent on enforcement mechanisms, does not reach unclassified or misclassified information, and does not stop the adversary from accessing an unprotected repository.
- T1213.002prevents — A.5.12's classification scheme (with associated protective controls, access alignment, and sharing agreements) directly constrains which SharePoint-stored items like policies, diagrams, credentials and source code can be placed where and accessed by whom, stopping the adversary from ever reaching many of them; it leaves a bounded remainder where misclassification, legacy content or intra-organization access still permits the technique.
- T1213.003prevents — A.5.12's classification scheme (with associated protective controls, access alignment, and owner accountability) directly constrains what sensitive source code or credentials can be stored or shared in repositories, preventing the technique from succeeding when properly applied; it is only partial because the control is governance-level, does not itself enforce technical access barriers, and leaves residual risk from misclassification, legacy data, or third-party SaaS repositories outside full organizational control.
- T1213.005prevents — A.5.12's classification scheme (with associated handling rules derived from impact, confidentiality, integrity, availability, and sharing needs) can prevent the technique when it causes sensitive chat content to be marked and protected so it is not stored or shared in messaging apps in the first place; this is only a slice of the technique because classification alone does not stop unclassified or misclassified data from being posted, nor does it block exfiltration of already-posted data.
- T1530prevents — A.5.12's classification scheme (with associated protective controls, owner accountability, and alignment to access control policy) directly drives correct handling/protection decisions that close the misconfiguration vector for sensitive cloud data, but leaves the separate credential-leak vector and inter-org scheme translation unaddressed.
- T1552.001prevents — A.5.12's classification scheme (with associated protective controls, owner accountability, and alignment to access-control policy) can prevent insecure storage of credentials in files by requiring higher-protection handling for sensitive credential data, but this is only a minority slice of the technique because the control does not mandate or enforce specific mechanisms that stop credential embedding, searching, or extraction from files, backups, configs, or logs.
- T1552.004prevents — A.5.12's classification scheme (with associated protective controls, owner accountability, and alignment to access-control policy) can require stronger storage/handling for private keys rated by impact, which prevents the 'insecurely stored' condition the technique relies on; this is only a slice because the control is purely governance/policy-level and does not itself enforce storage protections or stop search/export once keys exist.
- T1565prevents — A.5.12's classification scheme (with associated protective controls, owner accountability, and alignment to access-control policy) directly drives integrity protections scaled to business/legal impact, which prevents many classes of data manipulation by ensuring commensurate controls exist before the technique can succeed; it is only partial because the control stops at defining and communicating the scheme and does not itself enforce the resulting controls.
- T1565.001prevents — A.5.12's classification scheme (with associated protective controls, owner accountability, and alignment to access-control policy) directly drives integrity protections for stored data, closing the manipulation vector for many classes of information; it does not itself stop an adversary who has already obtained the necessary privileges or specialized tools.
- T1598.001prevents — A.5.12's classification scheme and associated handling/protection rules (including agreements on interpreting external classifications) can constrain what information is shared via third-party services and how employees treat inbound requests for it, thereby preventing some successful elicitation, but does not stop the adversary from sending the messages or using social engineering.
Prevented OWASP Web Top 10 (2025) risks (2)
OWASP Web Top 10 (2025) risk categories this ISO control helps prevent or mitigate — our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Control IDs, short titles and the structured attribute table (control type, CIA properties, cybersecurity-concept, operational capability, security domain) are facts from ISO/IEC 27001:2022 Annex A / ISO/IEC 27002:2022. The full implementation guidance prose lives in ISO/IEC 27002:2022 — not reproduced here. Cross-walks to NIST 800-53, NIST CSF 2.0, OWASP ASVS, CWE, MITRE ATT&CK and OWASP Web Top 10 are our own AI-authored analysis (authority llm_unverified, under review), not an ISO, NIST, MITRE or OWASP product — how ours compare.