No, you do not. The 4 levels of classification in ISO 27001 annex a 5.12 are explicitly stated as an example. The word example. And that it 'can' be based on the 4 levels. It is not the only way, or the required way, it is the example they give. For full reference the guidance is here: a) Disclosure causes no harm; b) Disclosure causes minor reputational damage or minor operational impact; c) Disclosure has a significant short-term impact on operations or business objectives; d) Disclosure has a serious impact on long term business objectives or puts the survival of the organisation at risk. It is not a bad example. It is just another layer of complexity to manage. You then have to say what you mean by words like 'minor', 'short-term'. Do what is right for you but do not over complicate it.