S 2.43 Adequate labelling of data media for dispatch

Initiation responsibility: IT Security Officer, Head of IT, Head of Organisation

Implementation responsibility: User

In addition to the implementation recommendations stated in safeguard S 2.3 Data media control, adequate labelling of data media to be exchanged must include clear identification of the sender and (all) recipients. The labels on the data media or its packaging must permit the recipient to clearly identify the contents of the data media. In the case of confidential information, though, the labels must not contain any information permitting unauthorised persons to determine the type and contents of the data stored on the data media.

For classified materials, the applicable confidentiality regulations must be followed in any case.

In addition, the data media should be labelled with the formats used and with the parameters necessary for reading the media. When transferring a DVD, for example, it must be noted on the label if the DVD is a video, audio, or data DVD.

The date sent as well as any version numbers or key features can also prove to be useful when labelling data media.

Review questions:

• Is it determined which communications partners may receive which information?
• Is is clear to all persons involved in communication who may receive which information?
• Does the labelling of the data media clearly show the contents to the recipient?
• Does the labelling of the data media with information to be protected ensure that no conclusions on type and contents of the information can be drawn?