12.1 Asset classification

Requirement

For the purpose of Article 21(2), point (i) of Directive (EU) 2022/2555, the relevant entities shall lay down classification levels of all assets, including information, in scope of their network and information systems for the level of protection required.

Guidance

• Create and document classification levels for the assets, including conventions for classification.

Examples of evidence

• Documented classification levels for the assets.

Requirement

For the purpose of point 12.1.1., the relevant entities shall: (a) lay down a system of classification levels for assets; (b) associate all assets with a classification level, based on confidentiality, integrity, authenticity and availability requirements, to indicate the protection required according to their sensitivity, criticality, risk and business value; (c) align the availability requirements of the assets with the delivery and recovery objectives set out in their business continuity and disaster recovery plans.

Guidance

• Ensure that classifications and associated protective measures for assets consider business needs, including:
  • sharing or restricting information;
  • protecting the integrity and authenticity of information;
  • ensuring availability (100); and
  • complying with legal requirements concerning the confidentiality, integrity or availability of the information.
• Define and communicate a classification for sensitive information, such as (indicative example):
  • public - freely accessible to all, even externally;
  • internal - accessible only to members of the entity;
  • confidential - accessible only to those whose duties require access.
• Use classifications derived from national law, international agreements or internationally accepted strategies for sharing information, such as the traffic light protocol.
• Align the classification with the access control policy (section 11.1).
• Classify assets in accordance with the identified classification levels.
• Classify assets other than information in accordance with the classification of the information they store, process, handle or protect.

Examples of evidence

• The latest, updated record of the entity’s assets and their classification based on the identified classification levels.

Requirement

The relevant entities shall conduct periodic reviews of the classification levels of assets and update them, where appropriate.

Guidance

• Define criteria for reviewing the classification over time.
• Review the classification at least annually, taking into account:
  • regulatory changes; and
  • changes in the value, sensitivity and criticality of the assets throughout their life cycle.

Examples of evidence

• Documentation showing the schedule for reviews.
• Records of the most recent review and logs detailing changes made during the last review, including reclassifications and the addition/removal of assets.

Tips: guidance

• Ensure that owners of the assets are responsible for their classification.
• Communicate to personnel the classification of assets and associated protection requirements.

Tips: examples of evidence

• Personnel knowing classification levels and protection requirements for each level.