This narrative ( 1 ) stated that Information is a corporate asset . . . . Information must be protected according to its sensitivity , criticality and value , regardless of the media on which it is stored , the manual or automated systems that process it , or the methods by which it is distributed , ( 2 ) outlined the responsibilities of information owners , custodians , and users , ( 3 ) defined the organization 's three data classification categories , and ( 4 ) stated that each business unit should develop an information protection program to implement these policies .
No matter what type of information it is , it must be protected .