Requirement
Information shall be classified according to the information security needs of the organisation based on confidentiality, integrity, availability and relevant interested party requirements.
What the engine looks for
Every group below must be satisfied — by an affirmative statement, not a plan, a hedge or a denial — for the control to count as covered. A term ending in … matches any word it begins. Supporting terms do not change the verdict — they raise confidence and distinguish a policy that names a mechanism from one that gestures at a category.
Finding any of these outranks coverage — a policy that admits the gap is worse than silence.
Equivalent controls elsewhere
Matched on shared topics. Satisfying this control usually moves these too.
| Framework | Control | Title | Shared topics |
|---|---|---|---|
| GDPR | Art.9 | Special category data | data-classification |
| GDPR | Art.10 | Criminal convictions and offences data | data-classification |
| CCPA/CPRA | 1798.121 | Right to limit use of sensitive personal information | data-classification |
| SOC 2 | C1.1 | Identification and protection of confidential information | data-classification |
| PCI DSS 4.0.1 | 3.4 | PAN is masked when displayed and protected from copying | data-classification |
| COPPA | 312.2-312.3 | Determine whether COPPA applies | data-classification |
| NIST CSF 2.0 | ID.AM-05 | Assets are prioritised by criticality | data-classification |
| NDPA 2023 | s.30 | Sensitive personal data | data-classification |