4.1.2. Information Asset Identification and Classification
💡 First Principle: Classification exists to make sure protective effort is spent where the business actually needs it, which means it has to account for more than secrecy — an asset can be entirely public and still deserve the strongest availability controls the program has.
A public-facing status page has essentially no confidentiality requirement, yet a business that depends on customer trust may need it to be highly available during an incident — precisely when it matters most. A properly designed classification scheme scores assets across all three CIA properties independently, not on a single confidentiality-only scale, so that an asset's classification actually reflects the protection it needs rather than just how sensitive its contents are. Those scores should come from the business impact of a compromise (including legal, regulatory and reputational consequences) as judged by the asset owner, not from convenient proxies such as transaction volume, storage cost or how often the asset is accessed.
| Classification Input | Question It Answers |
|---|---|
| Confidentiality requirement | Who is authorized to see this? |
| Integrity requirement | How costly is undetected corruption? |
| Availability requirement | How costly is this being unreachable? |
| Asset owner | Who has authority to make decisions about this asset? |
An accurate, current asset inventory — including who owns each asset — is the prerequisite that makes every later control decision possible; a control can't be scoped correctly to an asset the program doesn't know exists or doesn't understand the true classification of. Keeping it current means actively discovering assets that bypass formal procurement, such as SaaS tools bought directly by departments (shadow IT); an asset that never enters the inventory has no owner, no classification and no scoped controls.
⚠️ Exam Trap: Classification is often assumed to be purely about confidentiality labeling (Public/Internal/Confidential/Secret). The correct answer recognizes integrity and availability requirements as equally valid classification inputs — a low-confidentiality, high-availability asset still requires strong protection.
Reflection Question: A public marketing website and an internal HR database are classified using the exact same confidentiality-only scale. What protection needs might this scheme miss for each asset?
