Exam objective 2.1 challenges you to identify and classify information and assets before you can do anything else in security. This is the fundamental sorting problem: you cannot protect what you do not know you have. For your CISSP exam, this concept is the foundation upon which all other domain 2 topics are built, and the exam will test whether you understand the difference between classifying an asset and merely listing it on a spreadsheet.
Jump to a section
A simple way to picture Asset Security: Classification and Handling
The Museum Registrar is the professional who decides exactly what every object in a museum is worth and how it should be treated. They do not just look at a painting and say 'that is old'. They apply a formal classification system. For example, a dusty oil painting might be classified as 'Confidential' because it is an original masterwork worth millions, while a poster in the gift shop is 'Public' because anyone can buy a copy. The registrar then writes a handling policy: the masterwork must stay in a climate-controlled vault, be logged out by two staff members, and never leave the building without an armoured courier. The poster can be rolled up and handed to a visitor. This is exactly what information asset classification does inside a company. A system administrator looks at a database of customer credit card numbers and classifies it as 'Restricted' or 'Highly Confidential', then writes rules that say 'only five authorised people may access it, it must be encrypted at rest and in transit, and it must be destroyed after seven years.' The museum registrar and the security professional are doing the same job: identifying what is valuable, labelling it clearly, and dictating how it must be handled every second of its life. If the registrar does her job badly, a priceless painting gets left in direct sunlight and fades. If an IT professional does his job badly, sensitive data leaks and the company gets fined millions.
Information asset security begins with a simple truth: an organisation cannot protect something if it does not know it exists. Asset security is the practice of identifying all valuable information and technology resources, classifying them by sensitivity and criticality, and then defining how each class must be handled throughout its life. The entire process is governed by three core concepts: identification, classification, and handling.
Identification is the act of finding and recording every asset that has value to the organisation. An asset can be a customer database, a spreadsheet of employee salaries, a piece of software source code, a laptop, a server, a backup tape, or even a paper file in a cabinet. In IT terms, an asset is anything that, if lost, stolen, or damaged, would cause measurable harm. Identification answers the question 'what do we have?' and is usually done through an asset inventory. This inventory is a formal list, often stored in a database, that records each asset's owner, location, type, and value.
Classification is the process of assigning a sensitivity label to each asset based on its value and the harm that would result from its unauthorised disclosure, modification, or destruction. The two most common classification schemes are government/military (Top Secret, Secret, Confidential, Unclassified) and commercial (Highly Restricted, Restricted, Internal, Public). Classification answers the question 'how sensitive is this?' The label determines everything that happens to the asset next. For example, a public marketing brochure can be shared freely, but a spreadsheet of credit card numbers must be locked down. Classification must be done by the asset owner, who is the person best qualified to judge the asset's business value.
Handling is the set of procedures that apply to each classification level. Handling requirements cover every stage of the asset's life: creation, storage, transmission, access, retention, and destruction. For a Restricted asset, handling might include encryption at rest and in transit, multifactor authentication for access, audit logging of every view or edit, and secure deletion after a defined retention period. For a Public asset, handling might include no encryption requirement and open access to anyone inside the organisation.
Why does this exist? Before formal asset security, organisations treated all information the same way, which was either wasteful (overprotecting trivial data) or dangerous (underprotecting critical data). Classification introduces cost-effective proportionality: you spend the most security budget on the assets that would cause the most damage if compromised. This concept replaces the old 'one size fits all' approach with tiered protection that aligns with business risk.
The CISSP exam focuses heavily on the vocabulary and process flow. Key terms include: Owner (the person with ultimate responsibility for the asset, usually a senior manager who can assign classification), Custodian (the IT staff who implements the protection controls), User (any person who accesses the asset under the rules set by the owner), and Classification level (the specific label assigned). Another essential model is the 'state of data' concept: data at rest (stored on a hard drive or tape), data in transit (moving across a network), and data in use (being processed in memory). Each state may require different handling rules even for the same classification level.
A beginner-friendly example: Consider a hospital. Patient medical records are classified as Highly Restricted because if they leak, the hospital faces legal fines, lawsuits, and loss of reputation. The handling policy says: only doctors and nurses with a direct treatment relationship can access the records; the records must be encrypted on the server and when sent to another hospital; they must be audited every time someone views them; and they must be kept for seven years after the last visit, then destroyed by shredding or degaussing (demagnetising the hard drive). Meanwhile, the hospital's cafeteria menu is classified as Public. Anyone can see it, no encryption needed, and it can be thrown in the bin when outdated. The same organisation, two different assets, two completely different handling regimes.
Classification is not a one-time event. Assets change value over time. A trade secret formula may start as Highly Restricted, but after the patent expires it might become Public. Regular review and reclassification is a required part of asset management. The CISSP calls this 'lifecycle management' and expects you to know that the asset owner, not the custodian, is responsible for making the reclassification decision.
Finally, handling policies must define specific procedures for destruction. Simply deleting a file does not make it unrecoverable. For classified assets, destruction methods include: overwriting the storage media with random data multiple times (called 'clearing'), physically shredding the media ('degaussing' for magnetic tapes, or 'pulverising' for solid-state drives), or incinerating it. The higher the classification, the more thorough the destruction method must be. The exam will test that you know the difference between clearing, purging, and destroying, and that destruction must be certificated with a formal record.
Asset Discovery
Identify every information asset in the organisation using automated scanning tools, manual surveys, and interviews with department heads. Create a formal inventory that records each asset's location, owner, type, and estimated value. This step is critical because you cannot classify what you have not found.
Asset Valuation
Determine the criticality and sensitivity of each asset by assessing the harm (financial, legal, reputational) that would result from its loss, disclosure, or modification. The asset owner performs this assessment. This step produces the raw data needed to assign a classification level.
Classification Assignment
Assign a formal classification label (e.g., Public, Internal, Confidential, Restricted) to each asset based on its valuation. The label must be recorded in the asset inventory and, where possible, embedded as metadata on the asset itself. The owner authorises the label in writing.
Handling Policy Creation
Define specific handling rules for each classification level across all six lifecycle phases. Specify encryption requirements, access controls, storage locations, transmission methods, retention periods, and destruction procedures. Document the rules in a policy document that all employees can access and understand.
Control Implementation
Deploy technical and administrative controls that enforce the handling policy, such as data loss prevention tools, access management systems, encrypted storage, and automated deletion scripts. Test that the controls work before relying on them.
Training and Awareness
Train all employees, contractors, and third parties who handle classified assets on the classification scheme and their specific responsibilities. Provide job aids like reference cards and include classification topics in annual security awareness training.
Monitoring and Review
Continuously monitor compliance with handling rules using audit logs and periodic inspections. Schedule annual reviews with asset owners to reclassify assets as needed. Update the inventory, policy, and controls when classifications change.
An IT professional working as a data governance officer at a mid-sized financial services company is tasked with implementing a classification and handling programme. The company has never done this formally. Previously, every department stored customer data however they wanted, often on shared network drives with no access controls. The chief information security officer (CISO) has mandated compliance with a new regulatory standard that requires documented asset classification.
Step one: The officer runs a discovery tool that scans every server, laptop, and cloud storage bucket to identify all files containing personal data. The tool returns 15,000 files. The officer cannot classify 15,000 files manually. Instead, she groups them by the type of data they contain - customer name and address versus credit card numbers versus internal financial reports. She then interviews department heads (the asset owners) and asks them two questions: if this data were made public, how much money would the company lose? If this data were destroyed, how long would it take to recover? Based on the answers, she creates three classification levels: Internal (low impact, e.g., general memos), Confidential (moderate impact, e.g., employee performance reviews), and Restricted (high impact, e.g., customer account numbers).
Step two: She builds a handling matrix. For each classification level, she specifies:
Storage: Restricted data must live on an encrypted database with access limited to named users. Confidential data may live on a departmental shared drive with password protection. Internal data may live on any company file server.
Transmission: Restricted data must be sent using encrypted email or a secure file transfer protocol. Confidential data may be sent over internal email with a warning banner. Internal data may be sent with no encryption.
Access: Restricted data requires two-factor authentication and a logged reason for access. Confidential data requires a simple username and password. Internal data may be accessed by any employee.
Retention: Restricted data must be deleted after seven years. Confidential data after three years. Internal data after one year unless otherwise specified.
Destruction: Restricted data must be shredded or degaussed with a certificate of destruction. Confidential data may be deleted using a secure delete utility. Internal data may be deleted using the normal operating system delete command.
Step three: She deploys automated tools that apply rules to enforce the handling matrix. For example, a data loss prevention (DLP) tool scans outgoing email and blocks any email that contains Restricted data from being sent to an external address that is not pre-approved. An identity and access management (IAM) system automatically revokes access to Restricted data when an employee leaves the company. A backup system encrypts backups of Confidential and Restricted data but does not encrypt Internal data.
Step four: She trains every employee on what the classification labels mean and what they must do. The training includes examples: 'If you receive a file labelled Restricted, you must not copy it to your personal USB drive. If you need to share a Confidential file with a partner company, you must use the approved secure portal and log the request.' Employees are given a quick-reference card that lists the three levels and the corresponding handling rules.
Step five: She schedules an annual review. She meets with each asset owner to ask whether any data has changed in sensitivity. A customer list that was Restricted last year might now be outdated and can be downgraded to Confidential. A new proprietary algorithm is being developed and needs to be added as a Restricted asset. The classification labels are updated in the asset inventory, and the handling tools are reconfigured to match.
The result is a working system that balances security with usability. Employees know exactly what to do with each piece of data, auditors can see that controls are in place, and the company avoids the cost of overprotecting unimportant data. The IT professional's daily work involves monitoring the DLP alerts, handling exceptions, and updating the classification matrix whenever a new regulation or business requirement emerges.
The CISSP exam tests asset classification and handling primarily through scenario-based multiple-choice questions. You will not be asked to memorise specific classification labels (government versus commercial), but you will be tested on the concepts, the roles, and the process flow. The exam loves to set traps that confuse the roles of owner, custodian, and user.
Key exam topics to memorise:
The asset owner is the person who has the authority to classify and reclassify an asset. The asset custodian (IT staff) implements controls but does not decide the classification level. The user accesses the asset under rules set by the owner.
Classification is based on the harm that would result from compromise, not on the cost of the asset. A cheap database with millions of customer records may be Restricted, while an expensive server with no sensitive data may be Internal.
Handling includes all phases: creation, storage, transmission, access, retention, and destruction. The exam will test whether you remember all six phases, not just storage and transmission.
Data states: at rest, in transit, in use. A question may describe a scenario where data is encrypted at rest but not in transit, and ask you to identify the vulnerability.
Common trap patterns:
Trap 1: The question states that the CEO wants to downgrade a classification level on a file to save money on storage. The correct answer is that the asset owner (which might be a department head, not the CEO) must approve the reclassification. The trap is that beginners assume the CEO always has authority.
Trap 2: The question describes a custodian who decides to add extra security controls beyond what the handling policy requires. The correct answer explains that this is acceptable but the custodian must notify the owner. The trap is that beginners think custodians cannot add controls.
Trap 3: The question asks what happens to an asset after the retention period expires. The correct answer is that it must be destroyed according to the handling policy. The trap is that beginners think 'archived forever' is acceptable.
Trap 4: The question asks who is responsible for classifying a new asset created by a contractor. The correct answer is the organisation's asset owner (not the contractor). The trap is that beginners think the creator owns the classification.
Exactly which concepts appear? The exam often tests:
The difference between data classification (label assigned to content) and asset classification (label assigned to the container, e.g., a server).
The concept of 'security domain' — a set of assets that share the same classification and handling requirements.
The idea that classification supports the principle of 'least privilege' — a user should only have access to assets classified at the user's clearance level or lower.
The requirement that classification labels must be clearly visible, either as metadata tags on digital files or as coloured covers on physical documents.
A classic exam question: 'A company has a database containing personally identifiable information (PII) classified as Restricted. An employee copies the data to an unencrypted laptop. What is the primary failing?' The correct answer is that the employee violated the handling policy for Restricted data, which requires encryption during transport. The distractor answers might include 'the employee should not have had access' (wrong, because the employee may have been authorised to view the data but not to copy it without encryption).
Macro-level tip: When in doubt, remember that classification is about business impact. If a question asks which asset should have the highest classification, look for the one whose compromise would cause the most financial or reputational damage, not necessarily the one that seems most 'technical' or 'valuable' in raw cost.
The asset owner, not the custodian, holds the authority to classify and reclassify any information asset.
Classification labels are assigned based on the business impact of unauthorised disclosure, not on the cost of the asset itself.
Handling policies must cover six distinct phases: creation, storage, transmission, access, retention, and destruction.
Data can exist in three states — at rest, in transit, and in use — and each state may require different handling controls even for the same classification.
When the retention period expires, the asset must be destroyed using a method proportionate to its classification level, with formal certification.
Classification is not a one-time activity; periodic review and reclassification by the owner is mandatory for an effective programme.
These come up on the exam all the time. Here's how to tell them apart.
Asset Owner
Decides the classification level and handling rules
Is a senior business manager or executive
Has ultimate accountability for the asset
Asset Custodian
Implements and maintains the technical controls
Is an IT or security professional
Has operational responsibility but no authority to change classification
Classification
Assigns a sensitivity label to an asset
Based on the potential harm from compromise
Answers the question 'how sensitive is this asset?'
Handling
Defines specific procedures for managing labelled assets
Covers all six lifecycle phases
Answers the question 'what do we do with this asset?'
Data at Rest
Data stored on a hard drive, tape, or cloud storage
Protected by encryption of the storage media or device
Requires access controls for read or write operations
Data in Transit
Data moving across a network, email, or physical transfer
Protected by encryption in transit (TLS, VPN)
Requires integrity checks and secure channels
Clearing
Makes data unreadable through normal means
Suitable for assets reused within the same organisation
Methods include overwriting with zeros or random data
Purging
Makes data unrecoverable even with advanced techniques
Suitable for assets leaving the organisation's control
Methods include degaussing or specialised hardware erasure
Mistake
Classification level is decided by the IT department or the security team.
Correct
The asset owner, who is a business unit manager or senior executive, must decide the classification. IT implements the controls but does not decide the sensitivity label.
Beginners assume that because IT handles the technology, IT should also decide the label. But the owner understands the business value and potential harm better than the technical team.
Mistake
Once an asset is classified, the label never changes.
Correct
Classification must be periodically reviewed and can change as the asset's value or regulatory requirements change. The owner reclassifies the asset.
People think of labels as permanent because they feel official. But information value decays over time, and regulations change, so reclassification is a normal part of lifecycle management.
Mistake
All confidential data must be handled identically regardless of the organisation.
Correct
The handling rules are defined by the organisation's own policy, not by a universal standard. One company's 'Confidential' might allow email attachment, while another might require encrypted file transfer.
Beginners see the same words (Confidential, Secret) across different organisations and assume they mean the same thing. In reality, each organisation writes its own handling matrix.
Mistake
Asset classification only applies to electronic data and digital files.
Correct
Asset classification applies to all forms of information assets, including paper documents, physical devices, and even verbal knowledge held by employees.
The IT context of the exam makes beginners focus on databases and files. But CISSP considers all information assets, and physical security controls are part of handling.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
The asset owner is a senior business manager who decides the classification level and handling rules. The asset custodian is an IT professional who implements the technical controls to protect the asset. The owner has authority; the custodian has responsibility for execution.
There is no fixed number. Most organisations use three to four levels (e.g., Public, Internal, Confidential, Restricted). Too many levels become unmanageable; too few fail to differentiate between sensitivity tiers.
No. Only the designated asset owner for the business unit can assign a formal classification. An individual employee may suggest a classification, but the owner must approve it.
Clearing is a method of destruction that renders the data unreadable through normal means, such as overwriting the storage media with random data. It is suitable for assets that will be reused within the same organisation but not for assets being decommissioned.
Classification is the process of assigning the label. Data labelling is the act of physically or digitally marking the information with that label. They are related but distinct: classification happens first, labelling is the output.
Unclassified assets are a security gap. They are not protected by any specific controls, so they are vulnerable to unauthorised access, modification, or destruction. Organisations with no classification programme rely on ad hoc protections.
You've finished Asset Security: Classification and Handling. Continue through the CISSP study guide to build a complete picture of the exam.
Done with this chapter?