- Introduction
- Basic Security Principles
- Data Management: Determining and Maintaining Ownership
- Data Governance Policies
- Roles and Responsibilities
- Data Ownership
- Data Custodians
- Data Documentation and Organization
- Data Warehousing
- Data Mining
- Knowledge Management
- Data Standards
- Data Lifecycle Control
- Data Audits
- Data Storage and Archiving
- Data Security, Protection, Sharing, and Dissemination
- Privacy Impact Assessment
- Information Handling Requirements
- Record Retention and Destruction
- Data Remanence and Decommissioning
- Classifying Information and Supporting Asset Classification
This chapter is from the book
This chapter is from the book
This chapter is from the book
Classifying Information and Supporting Asset Classification
Asset classification involves assigning assets to groups, based on a number of common characteristics. Before you can classify assets, however, you must know what you have. You determine this through an asset inventory. Modern organizations rely heavily on asset inventories and the use of tools such as Asset Panda, AssetCloud, and ManagerPlus. These applications (and others) assist organizations in identifying, locating, and classifying their assets. The components of an asset inventory include items such as the following:
Asset name- Asset location
- Asset cost
- Asset owner
- Asset classification
- Data protection level required
The standard or process used to classify and manage assets is typically left to the discretion of an individual organization. Two things to consider are the size and structure of the organization and what is considered common in the country or industry in which the organization operates. Regardless of the particular approach, the asset classification process consists of five steps:
Create an asset inventory.
Assign ownership.
Classify based on value.
Protect based on classification.
Assess and review.
In addition to protecting its assets, an organization must protect the information maintained in those assets that is proprietary or confidential. Data classification is a useful way to rank an organization’s informational assets. A well-planned data classification system makes it easy to store and access data. It also makes it easier for users of data to understand the importance of the data. For example, if an organization has a clean desk policy and mandates that company documents, memos, and electronic media not be left on desks, it can change people’s attitudes about the value of that information. However, whatever data classification system is used, it should be simple enough that all employees can understand it and execute it properly.