Asset & Data Classification Policy (Annex A.5.12, A.5.13)

All information assets processed or stored must be classified into one of three tiers:

Classification	Definition	Examples	Handling & Encryption Requirements
Public	Information approved for public consumption.	Marketing material, public website content, open press releases.	No special controls required.
Internal	Routine internal business communication.	Internal memos, general team chat, operational manuals.	Restricted to company-managed devices; authenticated access.
Confidential	Sensitive client data, financial records, source code, credentials.	Client PII, customer server credentials, financial ledgers, private keys.	Strictly encrypted at rest and in transit; MFA mandatory; restricted access lists.