Why it matters
Not all data deserves the same handling — classification is what lets you apply proportionate controls.
How a self-led small team implements it
Two or three tiers (e.g. Public, Internal, Confidential) is plenty; avoid a five-tier scheme nobody will follow.
What auditors expect to see
Classification scheme, examples of labeled documents.
Track A.5.12 in your own Statement of Applicability — mark it applicable, log your justification, and link it to the risk that drove it.
Start your ISMS