The primary purpose of information classification is to ensure that information assets are protected in a manner commensurate with their value and sensitivity to the enterprise. The most critical factor in determining this classification level is the potential business impact that would result from the unauthorized disclosure (confidentiality), modification (integrity), or destruction (availability) of the information. By evaluating the potential for financial loss, reputational damage, operational disruption, or legal and regulatory penalties, the enterprise can assign an appropriate classification (e.g., Public, Internal, Confidential, Restricted). This impact assessment directly drives the selection of security controls and handling procedures.

A. Procedures for information handling are the result of an asset's classification, defining how it should be protected, not the basis for the classification itself.
B. Requirements for information retention are related to the information lifecycle and legal compliance but do not primarily determine the asset's sensitivity or confidentiality classification.
C. The media used for storage and backup is a control selected based on the information's classification, not a factor used to determine that classification.

1. ISACA

CGEIT Review Manual

8th Edition (2020). Domain 2: IT Resources

Section 2.5

discusses the optimization of IT resources. It emphasizes that information assets must be managed based on their value and the risk they represent to the enterprise. The classification scheme is a direct reflection of this value/risk assessment

which is fundamentally about the impact of a security failure.

2. ISACA

COBIT 2019 Framework: Governance and Management Objectives (2018). The management objective APO14 Managed Data states that a key practice is to "Define and maintain a data classification scheme." This scheme is based on business criticality and sensitivity requirements

which are determined by assessing the impact of a data breach on the enterprise. (APO14.03).

3. National Institute of Standards and Technology (NIST)

Special Publication (SP) 800-60 Vol. 1 Rev. 1

Guide for Mapping Types of Information and Information Systems to Security Categories (2008). Section 2.2

"The Security Categorization Process

" explicitly states: "The first step in the security categorization process is to identify the information types processed

stored

or transmitted by the information system. The second step is to determine the potential impact (low

moderate

or high) on the organization...with respect to the loss of confidentiality

integrity

and availability for each information type." This directly links classification to impact analysis. (Page 5).