Let’s begin Information Security by classifying an Organization’s Data in order to identify which Data requires Protection. The Overall Process includes the following steps:
Identify and Classify Sensitive Data Assets in Data Security – Initiation
Depending on the industry and organization, there can be few or many assets, and a range of Sensitive Data (including Personal Identification, Medical, Financial, and more).
Locate Sensitive Data Across the Enterprise
Security requirements may differ, depending on where the Data is stored. A significant amount of Sensitive Data in a single location poses a High Risk due to the damage possible from a single breach.
Determine Protection Requirements for Each Asset
The measures necessary to ensure Security can vary between assets, depending on Data Content and the Type of Technology.
Map Data Usage Within Business Processes in Data Security – Initiation
Analysis of Business Processes is required to determine what Access is allowed and under what conditions.
