Asset Classification
What is Asset Classification?
The process of categorising information assets based on their sensitivity, criticality, and value to the organisation. Classification levels typically include public, internal, confidential, and restricted.
Terms that appear alongside asset classification
Each of these is named in at least one of the same controls as asset classification. The number is how many controls name both.
- asset management 3 shared controls
- encryption 2 shared controls
- integrity 2 shared controls
- nist 2 shared controls
- configuration management database cmdb 2 shared controls
- risk assessment 2 shared controls
- risk register 2 shared controls
- configuration management 2 shared controls
Frameworks that govern asset classification
What the standards actually require on asset classification
Requirements naming asset classification across 6 standards, quoted from the control text.
Classify assets and label them where practicable, with the responsible owners determining protection needs under one uniform scheme that defines levels for confidentiality, integrity, availability and authenticity, reflecting the information each asset process...
C5-AM-06 · Asset Classification and Labelling →The entity must have a documented policy on encryption and cryptographic controls built on its approved data classification and ICT risk assessment, with rules for encrypting data at rest and in transit, data in use where necessary (or processing it in a separ...
dora-rts-on-ict-risk-management-framework-commission-delegated-regulation-eu-2024-1774::6 · Article 6: Encryption and cryptographic controls →The plan must require a risk-based asset management plan that prioritises resources with consistent criteria based on asset classification, criticality and business value, including dependencies and constraints of essential functions, and prioritises IAC cyber...
api-1164::ID.AM-5 · ID.AM-5 Resource prioritisation by classification, criticality and business value →Undertakings implement procedures ensuring CIA of ICT systems and services: vulnerability identification and remediation (patching, antivirus, compensating controls); secure configuration baselines;
EIOPA-ICTSG-GL.10 · ICT operations security →Kuwait NCF Identify function. Asset Identification and Classification: comprehensive Configuration Management Database (CMDB) covering hardware + software + data + cloud assets + IoT + OT/ICS + virtual + container + identity + business processes + suppliers.
KNCF-Identify-Asset-Risk-Management-CMDB-Classification-Crown-Jewels-CNI-NCSC-Sector-Designation · Kuwait NCF Identify + Asset Management + Risk + CNI + Crown Jewels →Asset classification criteria are set according to the business and all assets in scope are identified and listed, rated for importance and given security grades considering legal requirements and business impact, with the inventory kept current by periodic su...
south-korea-isms-p::1.2.1 · Identification of information assets →Questions people ask about asset classification
What is Asset Classification?
Why is Asset Classification important for compliance?
Which compliance frameworks address Asset Classification?
Where can I learn more about Asset Classification?
See how Asset Classification applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.