What are the FIRST two steps an organization should conduct to classify its assets?
Define user requirements and collate existing inventories
Categorize assets and set minimum security controls
Conduct an inventory of assets and determine the owners
Obtain senior management buy-in and conduct a risk assessment
Submit