All logical information assets covered by the ISMS, including system development information, vulnerability assessments, network diagrams and operational procedures, must be classified to reflect the protection level required based on the potential impact of unauthorized disclosure or alteration.
The classification must be carried out using well-defined criteria, which take into account, for example, the degree of confidentiality, integrity and availability of information. The classification is made at least at the following levels: non-public, public, confidential and strictly confidential.
