Information classification – how to perform a KRT classification step by step
Share
Last fact-checked: October 12, 2026 · Topic: information security, GDPR, and governance · Swedish application
Information classification involves an organization assessing the consequences if information is disclosed to unauthorized parties, becomes incorrect, or is unavailable when needed. The result is used to select reasonable security measures. Here you will find a concrete method, a classification matrix, and a worked-out example.
- Start by taking an inventory of information assets, not just IT systems.
- Assess three different security needs: confidentiality, integrity, and availability (CIA).
- Base your assessment on the consequence of a failure, not just on whether the data feels confidential.
- Document information owners, classification, justification, measures, and when the decision should be reviewed.
- A classification template is a working tool, not in itself proof that GDPR or other legislation is being followed.
What is the difference between information inventory and information classification?
Information inventory answers the questions of what information an organization has, where it is located, who is responsible for it, and how it is used. Examples include customer databases, production drawings, personnel files, quotes, agreements, and backups.
Information classification answers how serious the consequences could be if that same information is exposed, corrupted, or unreachable. The two activities go hand in hand: without an inventory, important information assets risk never being classified.
It is appropriate to distinguish information assets from the system. The same customer data can exist in CRM systems, email, accounting systems, and export files. A single system can simultaneously contain multiple information assets with different security needs.
Which three security needs are assessed in a CIA classification?
| Aspect | Question | Example of consequence |
|---|---|---|
| Confidentiality | What happens if unauthorized parties access the information? | Customer data is exposed or trade secrets are leaked. |
| Integrity | What happens if the information is altered or becomes incorrect? | Incorrect drawing version causes production defects. |
| Availability | What happens if authorized users cannot access it in time? | The ordering system is unavailable during a critical delivery. |
Each aspect is assessed separately. A public price list may have a low confidentiality requirement but a high integrity requirement. Personnel documents may have high confidentiality requirements without requiring constant availability.
How to perform an information classification – seven steps
1. Determine scope and responsibility
Define the business operation, process, or service. Appoint a business manager or information owner capable of assessing the consequences. IT and data protection functions can contribute, but the classification must be endorsed by the person who understands the importance of the information.
2. Inventory information assets
Register the name of the information asset, purpose, process, information owner, system and storage location, external recipients, and any presence of personal data. Avoid storing the sensitive data itself in the open inventory register.
3. Identify consequences for C, I, and A
Concretely describe what could happen to individuals, business operations, finances, reputation, and contracts if confidentiality, integrity, or availability fails. Also consider specific legal or contractual requirements.
4. Choose a common classification model
Determine consequence levels and clear criteria before you classify. A model with, for example, low, medium, and high consequence can be an educational internal example; it is not a universal legally mandated scale. The organization's established model must be used consistently.
5. Document level and justification per aspect
Record each CIA assessment separately, with a short justification and who approved it. Avoid using a single aggregate number that hides which specific security need is actually high.
6. Determine and allocate security measures
Match the classification against the actual risk profile. This may involve access restrictions, multi-factor authentication, logging, encryption, backups, restoration testing, version control, and follow-up routines. A high classification does not automatically lead to the same technical solution everywhere.
7. Follow up on changes
Designate a responsible person and a time for review, especially when information usage changes, new suppliers are connected, a major incident occurs, or a new system is introduced. Also verify that decided security measures have actually been implemented.
Example of a classification matrix for a small business
Assume a company that manages customer databases, manufacturing drawings, and a public product catalog. The following is an illustration of an internal three-grade consequence scale (1 low, 2 medium, 3 high), not a definitive decision for other companies.
| Information asset | C | I | A | Justification in brief |
|---|---|---|---|---|
| Customer database with contact details | 3 | 2 | 2 | Unauthorized disclosure can harm individuals; errors can disrupt customer relations. |
| Governing production drawings | 2 | 3 | 3 | Incorrect version or lack of availability can stop production and create quality defects. |
| Public product catalog | 1 | 2 | 2 | The content is public, but incorrect prices or downtime can affect customers. |
Important: The levels indicated are for educational purposes only. The organization must perform its own consequence and risk assessment. If information concerns Sweden's security, the Protective Security Act and separate classification rules may apply; a standard CIA matrix does not replace that assessment.
What does information classification have to do with GDPR and NIS2?
GDPR: Article 32 requires appropriate technical and organizational security measures based on, among other things, the risks to the rights and freedoms of natural persons. Information classification can be a useful basis, but it is not a specifically prescribed mandatory template method for all companies. The inventory is also not automatically the same thing as a record of processing activities according to GDPR Article 30.
NIS2 and Swedish cybersecurity regulation: For organizations subject to sector-regulated cybersecurity requirements, inventory, risk management, responsibility, and follow-up can be central parts of broader efforts. First check if the organization is actually covered and what requirements apply. See our guide on security measures and risk management for NIS2.
Information classification should also be coordinated with the incident response plan and the company's access management. Otherwise, the classification result risks becoming an isolated inventory list with no real security effect.
Checklist before approving the information classification
- Is there a complete and understandable list of priority information assets?
- Does each entry have a designated owner, update date, and clear scope of use?
- Have confidentiality, integrity, and availability been assessed individually?
- Can the levels be traced back to a commonly agreed-upon model?
- Are potential consequences for individuals and the business documented?
- Have security measures, responsible parties, and follow-up dates been defined?
- Have personal data, external suppliers, and shared copies been accounted for?
- Has the information owner reviewed and approved the result?
Five common mistakes to avoid
- Only inventorying IT systems. Important spreadsheets, paper documents, and exported files then remain invisible.
- Only classifying confidentiality. Integrity and availability can be just as important.
- Copying someone else's levels. Consequences and legal requirements can be completely different.
- Confusing classification with risk analysis. Classification describes security needs; risk analysis additionally considers threats, vulnerabilities, and probability.
- Lacking an action plan. A register without owners, measures, or follow-ups reduces its practical value.
Frequently asked questions about information classification
Do all companies need an information classification register?
No, there is no general GDPR requirement for a register with this specific name and format for all companies. However, risk-based requirements for appropriate protection of personal data apply, and other rules or contractual terms may impose additional requirements on the organization.
What information classification should personal data have?
There is no universal class that applies to all personal data. The risks depend on the type of data, purpose, scope, and the consequences an unauthorized disclosure or other error would cause.
Is information classification the same as security clearance?
No. General information classification based on CIA should not be confused with protective security classification under the protective security regulations, where other definitions and obligations may apply.
How often should the classification be reviewed?
There is no universal interval for every information asset. Determine a proportionate follow-up based on the pace of business change and risk; review in the event of significant changes, new information flows, or incidents.
Can Excel be used for information classification?
Yes, a well-thought-out Excel register can be practical for inventorying information assets, documenting classification decisions, and tracking measures. At the same time, the register needs to be protected appropriately and have clear version control.
Work practically with information classification
Do you want to gather information assets, CIA assessments, responsible owners, and follow-ups in one single work package? The Template Store's editable template includes Excel registers and supplementary documents.
See Information Classification & Information Inventory 2026/2027Once the classification is complete, you can continue with access audit and privilege review. See also templates for NIS2 and cybersecurity.
Official sources and further reading
- Swedish Authority for Privacy Protection (IMY) – GDPR Article 32 and full text of the regulation.
- IMY – Security measures and risk-based protection.
- SKR KLASSA – guidance for information classification.
- Fortifikationsverket – information security and classification.
Related guides: Read about retention and storage periods under GDPR, AI, cybersecurity, and IT contracts, and risk management and security measures under NIS2.
Note: The text is general guidance and not individual legal advice or an assessment of your organization's specific regulatory compliance. Rules, industry requirements, and security measures must be verified in their concrete context.
