4.1.2. Information Asset Identification and Classification
💡 First Principle: Classification exists to make sure protective effort is spent where the business actually needs it, which means it has to account for more than secrecy — an asset can be entirely public and still deserve the strongest availability controls the program has.
A public-facing status page has essentially no confidentiality requirement, yet a business that depends on customer trust may need it to be highly available during an incident — precisely when it matters most. A properly designed classification scheme scores assets across all three CIA properties independently, not on a single confidentiality-only scale, so that an asset's classification actually reflects the protection it needs rather than just how sensitive its contents are.
| Classification Input | Question It Answers |
|---|---|
| Confidentiality requirement | Who is authorized to see this? |
| Integrity requirement | How costly is undetected corruption? |
| Availability requirement | How costly is this being unreachable? |
| Asset owner | Who has authority to make decisions about this asset? |
An accurate, current asset inventory — including who owns each asset — is the prerequisite that makes every later control decision possible; a control can't be scoped correctly to an asset the program doesn't know exists or doesn't understand the true classification of.
⚠️ Exam Trap: Classification is often assumed to be purely about confidentiality labeling (Public/Internal/Confidential/Secret). The correct answer recognizes integrity and availability requirements as equally valid classification inputs — a low-confidentiality, high-availability asset still requires strong protection.
Reflection Question: A public marketing website and an internal HR database are classified using the exact same confidentiality-only scale. What protection needs might this scheme miss for each asset?
