Classifying information assets is a process of identifying and categorizing the data and information resources that are owned, controlled, or used by an organization, based on their value, sensitivity, and criticality.
Classifying information assets helps to determine the appropriate level of control that is needed to protect them from unauthorized access, use, disclosure, modification, or destruction. Control level refers to the degree of protection or assurance that a control provides against a risk.
Classifying information assets also helps to communicate risk to senior management, assign risk ownership, and facilitate internal audit. These are other benefits of risk management that are not directly related to determining the appropriate level of control.
The references for this answer are:
Risk IT Framework, page 11
Information Technology & Security, page 5
Risk Scenarios Starter Pack, page 3
