Document Marking
Everything needed to run a small-group roundtable from your document marking policy. The group decides when a file needs a visible mark, when the folder is the label, and what to do before a labelling product arrives. Includes a facilitator plan, agenda, discussion prompts, a four-stage tabletop, and a one-page handout.
The desk card is the homework. Print it and keep it where you work.
Join to save this for later.
Join to tell us if this was useful.
- 3labels: Public, Internal / Confidential, and Restricted
- Defaultunmarked information is not public
- Leavesa mark is required when information leaves the organization
- Any sizea header line, encrypted email for personal data, and the right folder are enough
As of 2022. Source: ISO/IEC 27001:2022
Outcomes
- Name the three labels in your document marking policy: Public, Internal / Confidential, and Restricted.
- Treat unmarked information as Internal / Confidential. Treat personal data and credentials as Restricted.
- Put a visible mark on information that leaves the organization, including email, print, a download, and a handoff.
- Use the folder permission as the label while the file stays inside. A labelling product can wait.
Agenda
| Time | Block | What happens |
|---|---|---|
| 0:00–0:10 | Welcome and hook | The person who owns the document marking policy opens. The facilitator tells one story about a leadership pack emailed with customer names and no mark. Ground rules. |
| 0:10–0:25 | Story round | Each person shares a file they sent, printed, or dropped in the wrong folder. Capture themes on a flip chart. |
| 0:25–0:50 | Guided discussion | Work through 3 or 4 topics chosen from what the story round brought up. |
| 0:50–1:10 | Tabletop scenario | Groups of 3 or 4 work through The unmarked pack, one stage at a time, then report back. |
| 1:10–1:20 | Gap check | Sticky notes: one document we could not label today. Group them and rank them. |
| 1:20–1:30 | Commitments and close | Hand out the desk card. Each person names one document they will mark this week and takes the card with them. If the policy is not written down, the close is the three labels. |
Discussion topics
What the policy says
The meeting starts from the document marking policy you already have. Three labels are enough: Public for what you have approved for release, Internal / Confidential for day-to-day work, and Restricted for personal data, contracts, pricing, financials, security documents, and credentials.
- Can we say the three labels without opening the policy?
- Who decides the label when two people disagree?
When a mark is required
A mark is required when someone who did not create the file has to know how to handle it. That is when information leaves the organization: an email, a printout, a download, or a handoff to a supplier.
- Which files left the organization this week with no mark?
- Where does the mark show on an email that carries personal data?
When the folder is the label
While a file stays inside, the folder permission carries the label. Put it where only the right people can open it. A folder takes the highest label of anything inside it.
- Which shared folder holds a file that should be Restricted?
- Who can open that folder today?
What a small team does without a tool
Size does not change the rule. A header or footer line, encryption on email that carries personal data, and the right folder are enough to start. A labelling product can come later. The policy does not wait for it.
- What mark can we add this week with the tools we already have?
- What are we waiting on a product to do that a header line already does?
The unmarked pack
Give each group one stage at a time, about 5 minutes apart. Groups answer each stage's question before seeing the next.
Tuesday, 8 a.m.
A leader emails a management pack to a board member. The pack includes customer names. Nothing on the file or the email says how to handle it.
What does your document marking policy require before that email goes?
Tuesday, 9 a.m.
Someone prints the pack for the meeting. The pages have no header and no footer.
What mark belongs on the printed copy, and who approves the print?
Tuesday, 4 p.m.
The file is saved in a folder that anyone in the organization can open.
Is the folder the label, or does the file still need a move?
Wednesday, 10 a.m.
A supplier is copied on the thread so they can help with the numbers. They can open the pack.
What has to be true before a supplier receives it?
Reveal debrief
- Customer names are Restricted. The email needs a visible mark, and encryption, before it goes to the board member.
- A printed Restricted pack is marked on every page. The person who owns the information approves the print.
- A folder anyone can open is the wrong label. Move the file to a folder that matches Restricted.
- A supplier is a handoff. The mark travels with the file, and only the people who need it receive it.
Handout
Habits
- Start from your document marking policy. Three labels are enough: Public, Internal / Confidential, and Restricted.
- Treat an unmarked file as Internal / Confidential. If it holds personal data or credentials, treat it as Restricted.
- Mark information when it leaves the organization: email, print, download, or a handoff.
- Encrypt email that carries personal data, and set the sensitivity so the next person can see it.
- Keep the file in a folder whose permissions match the label. Label the folder at the highest level inside it.
- Add a labelling product later if you want one. The mark does not wait for the product.
Red flags
- A file leaves with no mark
- Personal data in an email that is not encrypted
- A printed pack with no header or footer
- A folder anyone can open that holds Restricted files
- Two labels on the same file, and no person named to decide
- A labelling product on order, and no mark in the meantime
First hour
- Stop. Do not forward the pack again until it carries a mark.
- Mark. Put the label on the file, the email, and any printed copy.
- Move. Put the file in a folder whose permissions match the label.
- Tell. Tell the person who owns the information, and the people who already received it.
Facilitator checklist
2 weeks before
- Confirm the date, the room, and who is coming with the person who owns the document marking policy
- Ask each person to bring one real document they sent, printed, or stored this month
- Send the invite with the ask to bring one story
Day of
- Print the desk card, one for each person, plus the scenario cards (one stage per card) and sticky notes
- Set up a flip chart with four columns: Policy, Leaves, Folder, No tool
- Assign a note-taker
Within 1 week after
- Send a thank-you with the desk card and the top 3 gaps raised
- Give the policy owner the documents the group could not label, and the label each one needs
- Log who came
- If the three labels are not written down, schedule the hour to write them
ISO 27001:2022
- A.5.12 Classification of information
- A.5.13 Labelling of information
- A.5.14 Information transfer