Information Security Program · Topic 1 of 6
Program Resources and Asset Classification
People, tools and technology for the security program, skills and roles, and identifying, valuing and classifying information assets with their owners.
- 3 min
- Define roles and competencies from program tasks; plan for key-person risk.
- Choose tools from requirements and include the cost to run them.
- Every information asset needs a business owner.
What it is
Program resources are the people, tools, technologies and funding the information security program needs to deliver the strategy. Information asset identification and classification finds the organization's information assets, assigns owners and ranks them by value and sensitivity, so protection effort goes where it matters most.
How it works
People
- Define the roles the program needs from its tasks, then the competencies for each role, and compare with existing staff to find skill gaps.
- Close gaps through training, hiring, rotation or external services.
- Plan for key-person dependency with documentation, cross-training and succession.
- Many security tasks are done by people outside the security team (system administrators, developers, business managers); the program sets their responsibilities and supports them.
Tools and technologies
Tools are chosen to meet requirements that come from the strategy and risk assessment, not because they are new. The manager considers integration with existing systems, total cost of ownership, the staff needed to run them and how their effectiveness will be measured. A tool nobody has time to operate gives little protection.
Funding
Program resources are funded through the budget set in strategic planning. When resources are short, the manager prioritizes by risk and makes the remaining exposure visible to management, so the decision to accept it is theirs.
When asked how to justify more staff or tools, link the request to specific risks and business objectives the program cannot otherwise meet.
Information asset identification
An inventory of information assets covers data sets, the systems that hold them, the processes that use them and where they are stored, including cloud services and third parties. Each asset has an owner in the business who is accountable for it.
Valuation and classification
Value is based on what the asset means to the business: the impact of losing its confidentiality, integrity or availability, legal obligations and its importance to critical processes. The owner decides the classification using criteria in the classification policy.
| Typical level | Example content |
|---|---|
| Restricted | Payment card data, health records, trade secrets |
| Confidential | Customer lists, contracts, internal financials |
| Internal | Policies, internal communications |
| Public | Published marketing material |
Classification drives handling rules: access, encryption, storage location, sharing, retention and disposal. Fewer, clearly defined levels are easier to apply than many fine-grained ones.
Keeping it current
Classifications are reviewed periodically and when the asset or its use changes. Data that is combined or copied usually keeps the highest classification of its sources unless the owner decides otherwise.
How the exam asks about this
- "What should be done FIRST to protect information effectively?" Identify and classify information assets with their owners.
- "Who determines the classification of customer data?" The data owner.
- "The team lacks cloud security skills." Compare required competencies with current skills and close the gap through training, hiring or services.
What to remember for the exam
- Define roles and competencies from program tasks; plan for key-person risk.
- Choose tools from requirements and include the cost to run them.
- Every information asset needs a business owner.
- Owners classify; classification drives handling rules.
- Review classifications as assets and uses change.
Classifying everything as restricted overwhelms controls and budgets, and people stop taking the labels seriously.
Common mistakes
Buying tools before defining requirements.
Letting IT decide classification.
Inventorying systems but not the information they hold.
Check yourself
Who should classify an information asset?
Its owner in the business.
What does classification determine?
The handling rules for the asset, such as access, encryption, retention and disposal.
How should security staffing needs be determined?
From the program's tasks and the competencies they require, compared with current skills.
Topic 1 of 6 in Information Security Program
Test yourself on Information Security Program
The full ISACA CISM question bank has 1,044 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISACA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.