What is the goal of classification of information?

The primary goal of information classification, as outlined in the ISO/IEC 27001 framework, is to ensure that information assets receive an appropriate level of protection. This is achieved by systematically evaluating and structuring information based on its value, legal requirements, criticality, and sensitivity to unauthorized disclosure or modification. By categorizing information (e.g., as Public, Internal, Confidential, or Restricted), an organization can apply proportional and cost-effective security controls, focusing the most robust protections on its most sensitive assets.

A. Creating a manual for mobile devices is a specific security control (policy), not the fundamental goal of classifying all organizational information.
B. Applying labels is a mechanism used to implement the classification scheme; it is a part of the process, not the ultimate strategic goal itself.

1. ISO/IEC 27001:2022 - Information security, cybersecurity and privacy protection — Information security management systems — Requirements.

Annex A, Control 5.12 (Classification of information): The standard states, "Information shall be classified in terms of legal requirements, value, criticality and sensitivity to unauthorized disclosure or modification." This directly supports that the goal is to structure information based on these attributes, which collectively define its sensitivity.

2. ISO/IEC 27002:2022 - Information security, cybersecurity and privacy protection — Information security controls.

Section 5.12 (Classification of information), Purpose: The purpose of this control is "To ensure that information receives an appropriate level of protection, in accordance with its importance to the organization." This is achieved by structuring it according to its sensitivity and value.

3. Calder, A., & Watkins, S. G. (2019). IT Governance: An International Guide to Data Security and ISO 27001/ISO 27002 (7th ed.). Kogan Page Publishers.

Chapter 11, Asset Management, Section on Information Classification: The text explains that the objective of information classification is to assign a value to information to determine the most appropriate level of protection. This valuation is based on confidentiality, integrity, and availability needs, which is synonymous with assessing its sensitivity.