Information Security Handbook

Conducting an information categorization

The information security architect must work with the business and project stakeholders to properly categorize the information that will be used by the information system being analyzed.

Information categorization will aim to answer the following questions:

• What information assets will be processed by the information system?
• What is the value of those assets to your organization?
• What will it take to properly secure those assets in a way that is commensurate with their value?

Remember that not all data is made equal, and therefore not all data has the same value to the organization. As a result, your information categorization will play a key role in the development of your tailored information security ...