ISMS: Classify information: confidentiality, integrity and data protection

You classify each piece of information once, and Ariadne ISMS automatically passes the result on to every process and system that handles it. You don't have to rate each system separately, and your required protection stays traceable in the audit.

Prerequisites

• Classifications are part of managing a record. You are the Owner of the information or have the Key User or Admin role.
• As a Stakeholder, you can edit the information but not classify it.
• The information already exists, for example because you created it on a business process.

Two classifications, two questions

Each piece of information has two separate classifications. You need both for the information to count as fully classified.

Security classification

Confidentiality and integrity

C + I

You rate confidentiality and integrity, each on one level of the impact scale, and give one shared rationale. This determines the required protection of processes and assets.

Guiding questions

• Confidentiality: Who may this information reach, and how much damage is done if it goes beyond that group?
• Integrity: How much damage is done if this information is manipulated or it is unclear how a change came about?

Tip: You don't rate availability here. It comes from the business impact analysis on the business process.

Privacy classification

Personal data under GDPR

GDPR

You record whether the information contains personal data and whether special categories are involved. This shows at a glance which processes and systems are relevant for data protection.

Guiding question

• Whose rights are affected if something goes wrong with this information?

Tip: Required protection asks what a loss costs the company. Data protection asks whose rights are affected. Rate both independently.

Rate confidentiality and integrity

1. Open Information and select the information you want to classify.
2. Click the edit icon next to Security classification.
3. Choose a level under Confidentiality level and Integrity level.
4. Explain your rating under Rationale (optional). The rationale applies to both values.
5. Save the classification.

The levels of the impact scale

By default, Ariadne ISMS uses five levels. Levels and descriptions may differ in your organization. Only Ariadne Support can change them.

Record data protection

1. In the information, click the edit icon next to Privacy classification.
2. Select the applicable options from the table below.
3. Explain your choice under Add rationale (optional) if needed, and save.

Keep track of reassessments

Reassessment

When the next classification is due

Automatic

The ISMS schedules the next classification by itself. The more critical the information, the sooner it is due again. The Reassessment field shows when, for example "In 90 days".

How the due date is calculated

• New information: first due after 90 days.
• After classification, the higher value of confidentiality and integrity counts (see table).
• The privacy classification does not affect the due date.

Tip: If the interval for a level is set to 0, the ISMS does not schedule a reassessment for that level.

Your admin sets the intervals under Settings > Information classification. They may differ from the defaults in your organization.

When information counts as done

On the dashboard, information counts as Assessed when both the security and the privacy classification exist and the reassessment is not overdue. If a classification is missing, it appears under Action required as "Assess". If the reassessment is due, it shows "Reassess".

What your classification affects

Under Business processes in the information, you see which processes handle it. When your classification changes, the ISMS recalculates processes and assets automatically.

Related articles

• ISMS: Create business processes and link information
• ISMS: Perform a business impact analysis and understand the MTPD
• ISMS: Create assets, maintain dependencies and derive required protection
• ISMS: Settings, default values and data import