Grouping of Information Assets Sample Clauses

Grouping of Information Assets. In order to facilitate the classification of information assets and allow for a more efficient application of controls, it may be desirable to group information assets together. It is important to establish that the grouping of assets for classification is appropriate. A broad grouping may result in applying controls unnecessarily as the asset must be classified at the highest level necessitated by its individual data elements. For example, if a Human Resources unit decides to classify all of their personnel files as a single information asset and any one of the files contains a name and social security number, the entire grouping would need to be protected with the controls for a confidentiality of high. A narrow grouping allows for more precise targeting of controls. However, as there are more information assets to classify, this increases the complexity of the classification and the management of controls. Using the previous example, classifying the multitude of personnel files (e.g., appointment letters, timecards, position classifications, holiday waivers) as individual information assets requires specifying the set of controls for each classification. In the case of a system (e.g., database, data warehouse, application server), it may be easier to apply controls if the system is classified as a single entity. However, costs may be reduced by applying controls to individual elements (e.g., field, record, application). Therefore, it is important that NYSERDA evaluate the difference between the two scenarios to identify the most appropriate solution when determining the grouping of information assets for classification.