"Information shall be classified according to the information security needs of the organization based on confidentiality, integrity, availability and relevant interested party requirements."[1]

The organization must create several information/data classification categories. Data classification helps determine the security controls required to protect a certain type of data or information. Common data classifications include "Internal Use Only" "Business Confidential" and "Public". Depending on the organization's legal requirements additional classifications may be required.