DP002Information classification scheme

The categories information is assigned to, the handling rules that follow from each, and what happens to information nobody has assigned. The default is part of the scheme: a category that only the careful apply leaves everything else outside it.

Pillar: DP | Data and asset protection
Sources cited: 3
Added: 30 AUGUST 2026
Updated: 5 OCTOBER 2026

Control	Jurisdiction	Source	What it establishes	Prerequisite or recommendation
DP002/EUMandatory	European Union	Commission Implementing Regulation (EU) 2024/2690European Commission · read 29 Aug 2026	What the directive’s categories hold, in an annex setting out asset classification, the inventory, access control, privileged accounts, and removable media as requirements rather than as headings.	For the digital infrastructure and service providers it reaches, a system of classification levels is laid down and every asset is placed in one, on confidentiality, integrity, and authenticity. The handling policy that follows runs from acquisition through use, storage, and transport to disposal, and reaches everyone who handles an asset.
DP002/HUMandatory	Hungary	2024. évi LXIX. törvény Magyarország kiberbiztonságáról, 6. §, 10. §, 11. §, and 82. §Országgyűlés · read 5 Oct 2026	That the head of the organization establishes and operates a risk management framework, registers the systems, defines roles and responsibilities and appoints the person responsible for the security of the electronic information system, classifies the data, classifies each system into the “alap”, “jelentős”, or “magas” security class, determines and ensures the protective measures of that class, issues an information security policy reviewed at least every two years, evaluates the measures periodically, decides on taking systems into use, and reports threats, near-incidents, and incidents to the competent incident handling centre; and that the classification is reviewed at least every two years.	For the organizations in annex 1 of the Act, the head of the organization ensures the survey and classification of the data processed in the systems, and the result is one basis of the security classification.
Reported	Czechiawhere written	Redefining Threats: Extending the Threat Response Focus from External to Internal ThreatsHološka and Doucek · read 30 Aug 2026	How the examination of an employee is divided between security, human resources, and legal, what a classification level governs once it has been applied, and which restrictions are placed on a person serving out notice when they cannot be placed on everyone.	The classification level of a document governs how a person may work on it, with whom it may be shared, and where and how it may be kept. A document carrying the right level can then be followed by the loss prevention tooling, and access to it that was not permitted is raised as an incident.