The entity adopts internal rules, within the Article 5 rule set, for classifying information: how each class is marked, used, processed, exchanged, stored and destroyed, giving protection proportionate to the information's importance, sensitivity and legal requirements. Annex 2 offers a recommended four-level scheme (Level 0 to Level 3) with matching system requirements and TLP equivalents. The classification also applies to every resource involved in creating, processing, storing, transmitting or destroying the information, with protection matched to the identified threats. Classification levels must be marked on documented information. The markings reserved by the Classified Information Protection Act may not be reused in this scheme. Unclassified information is for general use under ordinary copyright rules. When information is exchanged, the TLP markings described in Annex 2 (RED, AMBER, GREEN, WHITE) are used.
This control maps to 2 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 2 it maps to, and the evidence behind each claim, over MCP and REST.