Asset classification and control

Information is a business asset and is of value to an organization. Information can exist in various forms, such as printed on paper, spoken in conversations, stored in electronic media, transmitted through e-mails and messages, and so on. Hence, irrespective of the location of the asset, its protection is vital and is based on the classification. In turn, classification is based on confidentiality, integrity, and availability requirements.

Asset classification is based on asset value. Various parameters are used in the industry to derive asset value. In general, asset value is based on the impact to the corporation in the event of disclosure, alteration, or destruction. Impacts could be loss of business, loss of corporate image, customer dissatisfaction, and so on. Hence, parameters to derive asset value may include, monetary value, intellectual property value, competitive advantage, privacy requirements, legal and regulatory requirements, and so on. Security...