COBIT 2019 Design and Implementation

Information security owns the protection of information assets, including applying a classification scheme that determines the safeguards required for data based on its security impact and sensitivity. NIST’s Risk Management Framework treats security categorization of information and systems as a security activity used to determine confidentiality, integrity, and availability impact.