Information Classification

Why information needs to be classified

Not every piece of information within a company requires the same level of protection. A public blog post demands different measures than an internal audit report or a penetration test result. Information classification creates a binding framework for evaluating data based on its value, sensitivity, and the impact of unauthorized disclosure — and for deriving appropriate protective measures.

Regulatory requirements make classification mandatory: ISO/IEC 27001 requires a documented classification scheme in Annex A (Control 5.12). The German BSI IT-Grundschutz defines protection requirement categories as the foundation for risk management. The GDPR demands appropriate technical and organizational measures for personal data protection — without classification, this appropriateness cannot be determined. And the NIS2 Directive requires risk-based information security in critical sectors, which is not achievable without classification.

The Traffic Light Protocol (TLP)

Our classification scheme is aligned with the Traffic Light Protocol (TLP) — an internationally established standard for the secure exchange of sensitive information. TLP was originally developed by the British National Infrastructure Security Co-ordination Centre (NISCC) and is now used by the German BSI, the Alliance for Cyber Security, and organizations worldwide.

The principle is simple: four color levels indicate how far information may be shared — from TLP:CLEAR (free to share) through TLP:GREEN (organization-internal) and TLP:AMBER (named recipients only) to TLP:RED (strictly confidential, direct recipients only). This creates a shared understanding between all parties — employees, clients, and partners — without requiring extensive security clearance procedures.