12.1.2 For the purpose of point 12.1.1., the relevant entities shall: (a) lay down a system of …

Requirement

For the purpose of point 12.1.1., the relevant entities shall: (a) lay down a system of classification levels for assets; (b) associate all assets with a classification level, based on confidentiality, integrity, authenticity and availability requirements, to indicate the protection required according to their sensitivity, criticality, risk and business value; (c) align the availability requirements of the assets with the delivery and recovery objectives set out in their business continuity and disaster recovery plans.

Guidance

• Ensure that classifications and associated protective measures for assets consider business needs, including:
  • sharing or restricting information;
  • protecting the integrity and authenticity of information;
  • ensuring availability (100); and
  • complying with legal requirements concerning the confidentiality, integrity or availability of the information.
• Define and communicate a classification for sensitive information, such as (indicative example):
  • public - freely accessible to all, even externally;
  • internal - accessible only to members of the entity;
  • confidential - accessible only to those whose duties require access.
• Use classifications derived from national law, international agreements or internationally accepted strategies for sharing information, such as the traffic light protocol.
• Align the classification with the access control policy (section 11.1).
• Classify assets in accordance with the identified classification levels.
• Classify assets other than information in accordance with the classification of the information they store, process, handle or protect.

Examples of evidence

• The latest, updated record of the entity’s assets and their classification based on the identified classification levels.

1. Yleiskatsaus

1.1 Viittaukset

1.2 Tunnistetut vaatimukset

1.3 Liittyvät säädökset

2. Tunnistetut vaatimukset

3. Liittyvät säädökset

Linkitetyt tehtävät

• ENISA -