One of the first steps in asset security is classifying and labeling assets. Organizations
often include classification definitions within a security policy. Personnel then label
assets appropriately based on the security policy requirements. In this context, assets
include sensitive data, the hardware used to process it, and the media used to hold it.