1. ISACA
CGEIT Review Manual
8th Edition (2020). Domain 4: Information Resources Optimization
Task Statement 4.02
states the need to "Ensure that information/data is classified in terms of criticality and sensitivity." The supporting text explains that this classification is essential to determine the required level of protection and appropriate handling procedures.
2. ISACA
COBIT 2019 Framework: Governance and Management Objectives (2018). Management Objective APO14
Managed Data
Practice APO14.02
"Define and implement a data classification scheme." The description states that this practice is necessary to "ensure that data is handled (e.g.
stored
archived
destroyed
accessed) according to its classification." This directly links classification to standardized handling.
3. ISACA
COBIT 2019 Framework: Governance and Management Objectives (2018). Management Objective APO14
Managed Data
Practice APO14.03
"Manage the data life cycle." This practice explicitly requires enterprises to "Define and implement procedures for data handling
including labeling
handling
storage
retention
retrieval and secure disposal
according to classification."