#1 - Identify and Follow the Data... Public > Internal > Confidential > Restricted Identify  Engineering, Financial, Business, HR, legal, and regulatory data (HIPAA, PCI, FISMA, DFARS, ITAR, EAR)  PII - Personally Identifiable Information (social security numbers, credit card information, personal health data)  IP - Intellectual Property (patents, trademarks, design plans - Engineering drawings) Follow  Once this information has been identified, a flow analysis needs to be conducted to identify all systems and devices the data either resides on or flows through.