What an auditor, or Sekit's evidence engine, asks for.
Data inventory and classification
The record of the personal and sensitive data the company holds, where it lives and how it is classified by sensitivity.
From the Sekit evidence catalog
In practice
Most SMEs write a three-tier classification scheme, then stop there. The labelling gap shows up on old files predating the policy, downloaded email attachments, and shared drives where nobody renames folders or adds a confidential banner. A workable rollout tags new documents automatically through templates or metadata fields, retrofits a batch of legacy folders instead of promising to relabel everything, and ties the labels to real handling rules, so a folder marked confidential has restricted sharing permissions in practice, not merely a label nobody enforces.
Common gaps
Classification scheme exists on paper, but files created before the policy carry no label and nobody has gone back to tag them.
Labels are applied at creation but never travel with the document once it is forwarded, downloaded, or copied to a shared drive.
Sharing tools have no idea the classification labels exist, so a confidential file can still be emailed externally with one click.
Questions your auditor will ask
How do you classify data, and where is that scheme documented?
In the data inventory and classification record, which lists sensitivity tiers such as public, internal, and confidential with handling rules for each.
Can you show me a confidential file that carries a visible label?
Yes, confidential documents carry a header or metadata tag applied through the document template, and reviewers spot-check a sample each quarter.
What happens when a labelled file leaves the company by email?
Sharing controls read the label and either restrict external sending or warn the sender before a confidential file goes outside the organization.
Who owns keeping the classification scheme current as data changes?
A named data owner reviews the classification scheme and label definitions annually, and updates them when new data types are collected.
Where regulation demands it
NIS2 12.2 requires handling rules tied to asset classification, and ENS mp.si.1 expects storage media to carry a visible marking that reflects sensitivity.
Related controls
Via the shared Sekit CSF topic, not the framework's own index.