Asset Inventory, Ownership, and Classification

The asset nobody listed

Every mature security team has met the same ghost. A breach report comes back, and somewhere in the timeline there is a database that nobody in the incident review had ever seen before. It runs on a server that was provisioned four years ago by a contractor, it holds production data that some department needed for a report, and it is not in the asset inventory, not in the configuration management database, not in anyone’s mind until the day it becomes the problem. The rest of the organization is surprised. The security team is not, because every security team knows that the inventory is always behind reality.

That gap is the subject of this chapter, and it is the reason Domain 2 exists. The CISSP exam begins asset security with a premise so obvious that candidates skip it: you can only protect, control, and recover the assets you know you have. Every other domain assumes the inventory exists. Risk analysis assumes you know the assets to value. Access control assumes you know which systems hold which data. Incident response assumes you know where the affected systems are and who owns them. Encryption, logging, patching, retention, all of them operate on named things. When a security program fails at asset security, it usually fails here first: not at choosing a control, but at knowing what the control is supposed to sit on.

The exam treats this as a management problem, and that is the angle that matters. Nobody can inventory a global enterprise by hand, and nobody can make inventory accuracy a one-time project. The discipline is structural: it assigns an owner to every asset, it classifies information so that handling follows automatically from the label, it values assets so that risk decisions have a number, and it builds the inventory into procurement, provisioning, and decommissioning processes so that the list stays honest. This chapter walks that structure in four movements: the inventory itself, the ownership roles that make it accountable, the classification schemes that turn data into handling rules, and the valuation that feeds the risk mathematics from Chapter 4.

The inventory: what counts as an asset

The first exam habit to build is breadth. When a CISSP question says “asset,” it does not mean hardware only, and it does not mean servers only. The working definition covers everything the organization depends on to produce value: information and data, hardware, software and licenses, systems and platforms, services and processes, people and their skills, facilities, vendor relationships, intellectual property, and reputation. The exam is especially careful to include the intangibles, because security professionals who were raised on rack-and-stack inventories forget them. A formula, a customer list, a brand, a trust relationship, a trained crew, all of these can be damaged, stolen, or lost, and all of them belong in the inventory if the organization treats them as things it must protect.

The standards give the inventory its shape. NIST Special Publication 800-53 Revision 5, “Security and Privacy Controls for Information Systems and Organizations,” contains the control that is essentially the audit finding that starts this chapter. Control CM-8, System Component Inventory, requires the organization to develop and document an inventory of system components that accurately reflects the current system and its environment of operation, to review and update the inventory at a defined frequency, to update it when components are installed, removed, or changed, and to keep the records of who accounted for what. The control’s enhancements go further: CM-8(3) requires automated detection of unauthorized components, which is the standard’s name for the shadow IT problem. If a laptop joins the network and the tooling detects that it is not in the inventory, the detection is not a violation of the process, it is the process working.

ISO/IEC 27001:2022 expresses the same duty in Annex A control 5.9, “Inventory of information and other associated assets.” The control states that information and other associated assets, including information processing facilities, shall be identified, and that an inventory including owners shall be developed and maintained. Notice the clause that the exam loves: the inventory includes owners. An inventory that records a server, a database, and a network segment but no owner is a shopping list, not a control. The owner clause is what turns the list into an accountability structure, and it is the bridge to the next section of this chapter.

The inventory record itself is where the discipline becomes concrete. A mature record for a single asset carries a stable unique identifier, the asset type, the owner, the custodian if one is appointed, the physical or logical location, the information classification of anything stored or processed on it, its criticality to the business, its value, its dependencies on other assets, and its retention obligations. The identifier is the part that fails most often in practice, because people name things for humans and not for machines. Two servers called “web01” in different regions, a database labeled by the name of the person who built it, a spreadsheet called “final_v2_really_final”, these are inventory failures wearing ordinary clothes. The exam does not test naming conventions, but it tests the underlying idea constantly: an asset must be identifiable uniquely, tracked from acquisition to disposal, and attributable to an accountable owner.

The tooling exists and the exam expects you to know what it is for, even though it does not quiz you on vendor names. The configuration management database, or CMDB, is the structured store that holds the inventory and the relationships between items. Asset discovery tools scan the network and enumerate what is attached, using both active probing and passive observation of traffic. Agent-based tools report from inside each managed endpoint, which is how an enterprise knows about laptops that only appear on the network intermittently. The point of the tooling is completeness, and the point of completeness is that the gap between the inventory and reality shrinks continuously. A team that discovers its own unknown assets is spending its time well; a team that learns about them from an incident report is not.

The failure mode that organizes this section is shadow IT: technology and data that exists outside the governed inventory. A department’s cloud subscription, a team’s homegrown database, a contractor’s forwarding rule, none of it is malicious, and all of it is dangerous, because every ungoverned asset is an asset with no owner, no classification, no patching, no monitoring, and no place in an incident. The exam scenario is usually a request to name the control that addresses shadow IT, and the family of correct answers is the inventory family: automated discovery, a provisioning process that creates inventory records at acquisition, and a decommissioning process that removes them at disposal. Prevention beats detection here, and process beats tooling.

Ownership: the roles and the accountability line

The single most-tested distinction in Domain 2 is the one between the owner of an asset and the custodian of an asset, and it deserves to be stated so plainly that it becomes reflexive. The owner is the accountable party: the senior business or mission manager who decides the asset’s classification, who approves who may access it, and who answers for its protection. The custodian is the implementer: the role, often in IT or security operations, that carries out the owner’s decisions, runs the controls, performs the backups, applies the labels, and manages the day-to-day handling. The exam’s favorite question hands you a sentence like “who is responsible for deciding the classification of the customer database” and offers the DBA, the IT manager, the data owner, and the security analyst. The answer is the data owner, because classification is a decision about business value and harm, not a technical task.

ISO/IEC 27001:2022 makes the same point structurally by requiring the inventory to name owners, and NIST Special Publication 800-53 assigns comparable roles across the federal framework, where every system has a system owner and every category of information has an information owner. The exam vocabulary is a little wider than the standards, and it is worth learning the full cast:

Two features of this table do most of the exam work. First, accountability never transfers. A custodian can run the backup, the encryption, and the monitoring, but the owner still answers for the protection of the data, and no amount of delegation moves the final accountability to the technician. The exam tests this by describing a breach on a system whose custodian did everything right and asking who is ultimately accountable, or by describing a custodian who quietly reclassified data to avoid a control and asking what is wrong with the picture. Second, the roles can be held by the same person in a small organization, and the exam will sometimes say so explicitly to make a point: in a small company the owner and the custodian may be the same individual, but the roles remain distinct conceptually, and a question that asks for the role rather than the person must still be answered with the role.

The practical work of the roles runs in a loop. The owner sets the classification and the access policy. The custodian implements and operates the controls, and reports status back. The owner reviews, reclassifies when the business changes, and accepts the residual risk at the level of authority that can bear it, which is the governance line from Chapter 3 applied to data. When a question asks who accepts a residual risk on a dataset, the answer is the data owner, not the analyst who assessed it and not the custodian who runs the controls. That pattern, decision at the owner, execution at the custodian, accountability at the owner, is the spine of every asset security question.

Classification: the map from data to handling

Classification is the decision that a particular set of information will be treated at a particular level of care, and its whole purpose is to convert the infinite variety of data into a small number of handling regimes. Nobody can write bespoke handling rules for each file. Classification collapses the world into three to five classes, each with a defined set of protections: who may see it, where it may live, how it is transmitted, how it is stored, how long it is kept, and how it is destroyed. The exam wants you to see classification as a management control with a business logic, not as a labeling ceremony.

The logic sits on two axes, and candidates who confuse them lose questions. Sensitivity is the potential harm from unauthorized disclosure: what happens if this information becomes public. Criticality is the potential harm from loss or unavailability: what happens if this information cannot be used when the business needs it. A marketing brochure is low on both. The customer list is high on sensitivity and medium on criticality. The order-processing system may be low on sensitivity, it holds no secrets, and very high on criticality, because the business stops when it stops. The exam will give you an asset and ask what its classification should be, or give you a classification and ask which property it reflects, and the discriminator is always which axis the harm statement maps onto. Confidentiality harms, disclosure harms, and “should not be seen” language point at sensitivity. Availability harms, outage harms, and “the business depends on it” language point at criticality.

The classification schemes the exam expects you to recognize are the three families that dominate the world. The first is governmental, and it is defined by Executive Order 13526, “Classified National Security Information,” issued in December 2009. The order establishes three levels of classification for national security information. Confidential is the lowest level, for information whose unauthorized disclosure reasonably could be expected to cause damage to the national security. Secret is the next level, for information whose unauthorized disclosure reasonably could be expected to cause serious damage. Top Secret is the highest, for information whose unauthorized disclosure reasonably could be expected to cause exceptionally grave damage. The three words, and the three damage adjectives, damage, serious, and exceptionally grave, are exact and the exam tests them exactly. The order also sets the lifecycle machinery, including automatic declassification of records after twenty-five years unless the information falls under defined exemptions, which is the clearest real-world example of the declassification step discussed below.

The second family is commercial, the schemes used by private-sector organizations, and there is no single standard here, which is itself a point the exam makes: a commercial scheme is whatever the organization defines and documents, and its value comes from the handling rules attached to each class, not from the class names. The common pattern runs from public, meaning no harm in disclosure and usable by anyone, through internal, meaning for employees and authorized partners, then confidential, meaning restricted to named individuals or roles and protected in transit and at rest, to restricted or highly confidential at the top, meaning the organization would be seriously harmed by disclosure and applies the strictest controls. What matters for the exam is not memorizing one vendor’s names but the two rules that make any scheme work: the classes must be mutually exclusive so that every piece of information lands in exactly one class, and the handling requirements must be defined for each class before anyone is asked to classify anything.

The third family is regulatory, the categories that law and contracts force onto data regardless of what an organization’s internal scheme says. These are not alternatives to a classification scheme, they are obligations that sit on top of it, and a dataset’s internal class and its regulatory category can both be true at once. The categories worth knowing cold are the three that appear in almost every practice question. Personally identifiable information, or PII, is defined in NIST Special Publication 800-122, “Guide to Protecting the Confidentiality of Personally Identifiable Information,” as any information about an individual that can be used to distinguish or trace their identity, such as name, social security number, or biometric records, or that is linked or linkable to them, such as medical, educational, financial, or employment information. Protected health information, or PHI, is the HIPAA category: individually identifiable health information, defined in the HIPAA regulations at 45 CFR 160.103, covering anything from a diagnosis to a billing record that identifies a person. Cardholder data is the PCI DSS category, defined in the PCI Data Security Standard version 4.0 as the primary account number plus, in combination, the cardholder name, expiration date, or service code, with sensitive authentication data, the full track data, card validation codes, and PINs, treated even more strictly and not to be stored after authorization.

The European Union adds a fourth regulatory layer that the exam includes because GDPR is now global in effect. The GDPR, Regulation (EU) 2016/679, distinguishes ordinary personal data from the special categories in Article 9: data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, biometric data processed to uniquely identify a person, health data, and data about a person’s sex life or sexual orientation. Processing the special categories is prohibited unless one of the Article 9(2) conditions applies, which is a far higher bar than the general lawful-basis rules that govern ordinary personal data. The exam scenario is usually a list of data types with a request to identify the one that belongs to the special categories, and the discriminator is that list, which is worth memorizing as exactly the sentence above.

One more rule organizes the whole classification picture: classification is a decision, and labeling is a task. The owner decides the class, against documented criteria, at the moment the information is created or collected, and the custodian applies the label, both the visible marking and the metadata, as a routine operation. ISO/IEC 27001:2022 separates exactly these two duties in Annex A: control 5.12, “Classification of information,” requires information to be classified according to the organization’s security needs based on confidentiality, integrity, and availability, and control 5.13, “Labelling of information,” requires the labels to follow the classification scheme. A label that does not match the underlying classification is a control failure, and the exam likes to test the direction of the mismatch: a low-classification label on high-sensitivity data, which causes under-protection, is the dangerous failure, while over-classification, protecting trivial data as if it were sensitive, is the costly and common one, because it trains people to ignore labels.

The categorization model to know cold: FIPS 199

If the exam asks you to reason about classification with a named standard, the answer is almost always FIPS 199, “Standards for Security Categorization of Federal Information and Information Systems,” issued by NIST in February 2004. It is the closest thing the discipline has to a universal classification arithmetic, and it is small enough to carry entirely in your head.

The model has two parts. First, every information system and the information it processes, stores, or transmits is assessed against three security objectives: confidentiality, integrity, and availability. Second, each objective is rated at one of three impact levels. The rating is the expected adverse effect if that objective is lost or violated. Low means a limited adverse effect, such as a minor financial loss or minor harm to individuals. Moderate means a serious adverse effect, such as significant financial loss or significant harm to individuals. High means a severe or catastrophic adverse effect, such as major loss of life, serious bodily harm, or severe financial loss that could threaten the organization’s solvency. The definitions are in the standard, and the exam quotes their shape if not their exact wording.

The arithmetic rule is the part candidates miss. The overall security category of a system is the high-water mark: the highest of the three individual ratings. A system whose information is high on confidentiality, moderate on integrity, and moderate on availability is categorized as a high-impact system, and it must be protected at the high baseline regardless of the two moderates. The logic is that a system is only as protected as its most sensitive capability requires, and the exam tests the rule by giving you three ratings and asking for the category. It is a one-step operation, and it is always the maximum, never the average.

The categorization output is not the endpoint, it is the input to control selection, which is where the model connects to the Risk Management Framework from Chapter 4. The system’s impact level from FIPS 199 picks the control baseline from NIST Special Publication 800-53, low, moderate, or high, and NIST Special Publication 800-60, “Guide for Mapping Types of Information and Information Systems to Security Categories,” supplies the mapping that helps an organization decide which impact level each type of information warrants in the first place. The full journey, categorize, select, implement, assess, authorize, monitor, is the RMF sequence Chapter 4 laid out, and FIPS 199 is its engine. If a question hands you a system and asks what the categorization is based on, the answer is the impact on the three security objectives if the system fails, and if it asks what the category is used for, the answer is selecting the security controls.

FIPS 199 also illustrates something the exam wants you to internalize about classification as a discipline: it is systematic, repeatable, and documented. The high-water mark rule removes discretion at the moment of combination, even though the initial ratings require judgment. That is the right shape for any classification scheme: judgment at the classification decision, and mechanical rules everywhere downstream, so that the handling never depends on the mood of the person carrying the file.

The classification lifecycle

Classification is not a one-time marking; it is a lifecycle that runs with the data. The exam organizes the lifecycle around the moment the information is created or collected, the period it is handled, the changes it undergoes, and the way it leaves the organization. Chapter 10 covers the disposal end in detail, including retention schedules and sanitization, so this section stops at the boundaries of what belongs here: classification, handling, and the changes a class can undergo.

The creation step sets the default. Information is classified when it is created or collected, against the documented criteria, and the class determines the handling from the first moment: where it may be stored, how it is transmitted, who may access it, and how it is labeled. The exam likes the failure mode where a classification happens only when someone thinks of it, because data created outside the scheme, in a personal drive, a messaging channel, or a personal mailbox, is data that skipped its lifecycle entirely.

The handling step is the cascade of rules attached to each class, and the exam tests it as a set of matching tasks: each class maps to storage rules, transmission rules, access rules, and sharing rules, and the discriminator in the question is usually which class the data carries, not which rule is generally best. This is also where the ownership roles bite: the owner defines the handling rules when the scheme is designed, and the custodian operates them every day, so a question about who writes the rule and a question about who applies it have different answers.

The change steps are three, and the exam distinguishes them precisely. Reclassification is moving data to a different class because the business circumstances changed: a merger makes a customer list more sensitive, a product launch removes the secrecy around a feature, a legal change adds a retention obligation. Downgrading is the specific case of moving to a lower class, and it is treated with suspicion because the only safe direction of movement under uncertainty is up. Declassification is the removal of classification entirely, and the governmental world gives it its sharpest form in Executive Order 13526’s twenty-five-year automatic declassification. Three rules govern all the changes: they must be made by the owner, not the custodian; they must be documented, because an audit trail of who changed what class and when is what makes the process reviewable; and they must be communicated, because a class nobody knows about protects nothing.

One failure mode deserves emphasis because the exam returns to it: the over-classification trap. When classification criteria are vague or owners are cautious, everything drifts upward, and the scheme dies of its own weight, because people who cannot distinguish the truly sensitive from the merely labeled stop respecting the labels. The exam scenario describes an organization where “everything is confidential” or where staff routinely mark documents confidential to skip review, and the correct response is that the scheme’s value collapses when classes no longer discriminate. The same logic explains why the two-axis model matters: a scheme built on sensitivity alone mis-handles the critical-but-public systems, and a scheme built on criticality alone leaks the sensitive-but-cheap data.

Valuation: putting a number on what you protect

The final movement of the chapter is the one that feeds the mathematics. Chapter 4 introduced the risk register and the four quantities: asset value, exposure factor, single loss expectancy, and annualized loss expectancy. The first of those, asset value, is decided here, because valuation is an asset security function, not a risk function. Before anyone can compute SLE equals AV times EF, someone has to decide what the asset is worth.

The exam’s first valuation lesson is breadth again. Asset value is not the sticker price of the hardware. For a database, the value is the sum of what the data is worth: the cost of recreating it, the revenue it generates, the decisions that depend on it, the regulatory fines its loss would trigger, the legal liability its disclosure would create, and the competitive advantage its secrecy provides. For a system, the value includes the business process it carries, so a small, cheap system can be a very expensive asset because the process it serves is. The classic exam discriminator is a question that offers a hardware replacement cost as the answer and a business-impact figure as the alternative; the business-impact figure is the asset value the risk mathematics needs.

Valuation methods follow ordinary finance, and the exam expects you to recognize the three basic approaches. Cost-based valuation values an asset at what it costs to acquire or replace, including the labor of recreating the data. Income-based valuation values it at the future cash flows it generates or supports. Market-based valuation uses what similar assets trade for. The practical answer in most enterprises is a blend, with the caveat the exam respects: the value must be defensible in front of the people who spend on controls, which means it must be documented and updated, because a valuation from five years ago is a number, not a value.

Two distinctions complete the picture. First, valuation is not the same as classification, and the exam separates them cleanly. Classification assigns a handling class based on sensitivity and criticality. Valuation assigns a monetary amount based on the consequences of loss. The two interact, a high-classification asset usually has a high value, but a public brochure has near-zero sensitivity and can still have real value to the business that sells it, and the exam likes to test the separation by asking which question classification answers and which one valuation answers. Second, the value feeds the decision, and the decision is the point: the SLE and ALE arithmetic from Chapter 4 turns the asset value into an annualized expected loss, and that number is what the organization compares against control spending. An asset that was never valued cannot enter the risk register, and an asset that never entered the register cannot be defended with a budget.

Ownership, classification, and valuation as one system

The three movements of this chapter are not separate subjects; they are one machine, and the exam’s asset questions usually engage the machine at its joints. The inventory asks what exists and who owns it. The ownership roles ask who decides and who executes. The classification scheme asks what handling the data deserves. The valuation asks what losing it costs. A single scenario can exercise all four: a new data store appears in a department, the inventory question asks how it gets discovered, the ownership question asks who decides its classification, the classification question asks what class it warrants given what it holds, and the valuation question asks what the risk mathematics should use as its asset value.

Hold the machine’s rules in order. The inventory must be complete, current, and owner-bearing. The owner decides classification and access; the custodian implements and operates. Sensitivity and criticality are separate axes, and both feed the class. The class drives the handling, and the labels must match. FIPS 199 gives the categorical model that runs the whole system in the federal world: three objectives, three impact levels, high-water mark. And valuation gives the risk register its numbers, so that the entire apparatus ends in a decision someone can defend.

Practice questions

1. During a routine review, a security team discovers a departmental database that has been running for three years outside the asset inventory. It holds production data and has never been patched, monitored, or assigned an owner. Which control set should the organization rely on to keep this class of problem from recurring?

A. Network segmentation and access control lists B. Automated asset discovery, acquisition-time inventory records, and decommissioning procedures C. Annual penetration testing of the production environment D. Full-disk encryption on all endpoints

2. A senior manager who owns the customer relationship database asks the IT team to begin encrypting backups of that database and to review the storage locations where copies are kept. Which role is performing which function?

A. The custodian is implementing controls; the owner directed them B. The owner is implementing controls; the custodian directed them C. Both roles are performing owner functions, since they are the same person D. The custodian is reclassifying the data without approval

3. An organization is categorizing a new system under the FIPS 199 model. The assessors rate its confidentiality impact as high, its integrity impact as moderate, and its availability impact as moderate. What is the system’s overall security category?

A. Low, because two of three objectives are moderate or below B. Moderate, as the average of the three ratings C. High, because the highest of the three objective ratings governs D. Undetermined until the controls are selected

4. Which statement correctly describes the three classification levels of Executive Order 13526?

A. Confidential, Secret, and Top Secret, distinguished by expected damage from unauthorized disclosure B. Confidential, Internal, and Restricted, distinguished by the audience allowed to view the information C. Public, Sensitive, and Private, distinguished by commercial handling requirements D. Low, Moderate, and High, distinguished by impact on availability

5. A new employee at a financial institution is told that cardholder data includes the primary account number together with the cardholder name, expiration date, or service code, and that a separate, stricter category exists. What does the stricter category consist of?

A. The primary account number alone B. Full track data, card validation codes, and PINs, which must not be stored after authorization C. The cardholder’s billing address and phone number D. Transaction history older than one year

6. Under the GDPR, which of the following data types belongs to the Article 9 special categories?

A. A customer’s purchase history B. An employee’s professional email address C. Biometric data processed to uniquely identify a person D. A company’s sales forecast

7. A system’s data is rated low on confidentiality but the system carries a business process that must not stop. What classification logic applies?

A. The system should be classified high on sensitivity because the business depends on it B. The system is low on sensitivity and high on criticality, and each axis feeds classification and handling separately C. The system should be marked confidential so that its availability requirements are enforced D. Availability ratings do not affect classification, so the system should be treated as low impact

8. An inventory record for a production server is found to list the hardware model, the IP address, and the facility, but no person or role responsible for it. Which requirement does the record fail?

A. The inventory must be stored in a configuration management database B. The inventory must name an owner, because accountability is what makes an inventory a control C. The inventory must include the replacement cost of every asset D. The inventory must be updated annually

9. A marketing manager created a product roadmap document and marked it “Confidential” because the process was convenient, even though the criteria for that class require the organization to be seriously harmed by disclosure. What is the most important consequence?

A. The document will be protected exactly like genuinely sensitive material, so the labeling is harmless B. Over-classification erodes the scheme, because labels that no longer discriminate stop being respected C. The data owner has committed a regulatory violation D. The document must be destroyed at the end of the business day

10. During a risk analysis, the analyst needs a monetary value for a database to compute the single loss expectancy. Which figure best represents the asset value?

A. The retail price of the server hardware that hosts the database B. The cost to recreate the data, the revenue it supports, and the fines and liability its loss would trigger C. The annual license fee for the database software D. The original purchase invoice, unadjusted for age

11. Which pair of actions correctly matches the owner and custodian roles?

A. Owner applies backup labels; custodian decides the classification scheme B. Owner decides classification and approves access; custodian implements storage, labeling, and backup controls C. Owner monitors logs daily; custodian accepts residual risk D. Owner and custodian jointly decide the classification at every reclassification

12. An organization’s information is reclassified to a lower class after a product launch removes the secrecy around a feature. What must accompany this change?

A. Nothing, because downgrading is the routine maintenance task of the custodian B. Approval by the owner, documentation of the change, and communication of the new class C. Automatic destruction of all prior labels D. Re-valuation of the asset at market rates

Answers and rationales

1. B. The inventory family is the prevention for shadow IT: automated discovery finds components the provisioning process missed, acquisition-time records create the inventory entry when the asset is created, and decommissioning procedures remove it when it leaves. Segmentation and encryption are protections for known assets, not mechanisms for discovering unknown ones (options A and D), and penetration testing finds exploitable weaknesses, not unmanaged systems (option C).

2. A. The owner directs the protective measures, and the custodian implements them. Directing control implementation is an owner function; running the backups and reviewing storage is custodian work. The roles remain distinct even if the same person holds both in a small organization, and nothing in the scenario is a reclassification (option D).

3. C. Under FIPS 199, the overall security category is the high-water mark, the highest of the three objective ratings. With one high, the system is categorized at high impact regardless of the moderates. The category is not an average (option B), and it is not deferred to control selection (option D); the category is what drives control selection.

4. A. Executive Order 13526 defines Confidential, Secret, and Top Secret, distinguished by the expected damage from unauthorized disclosure: damage, serious damage, and exceptionally grave damage. The other options mix in commercial class names or the FIPS 199 impact scale, which belong to different models.

5. B. Under PCI DSS, sensitive authentication data, the full track data, the card validation code, and the PIN or PIN block, must not be stored after authorization, which is stricter than the rules for cardholder data. The PAN alone, the billing address, and old transaction history do not form the stricter category as described.

6. C. Article 9 of the GDPR lists biometric data processed to uniquely identify a person among the special categories, along with health data, genetic data, and data revealing race, political opinions, religion, or trade union membership. Purchase history, a professional email address, and a sales forecast are ordinary personal data or non-personal data.

7. B. Sensitivity and criticality are separate axes. The system is low on sensitivity, no confidentiality harm from disclosure, and high on criticality, the business stops without it, and both axes feed classification and handling. Confusing them by raising the sensitivity class (option A) or ignoring availability (option D) misclassifies the asset.

8. B. ISO/IEC 27001:2022 Annex A control 5.9 requires the inventory to name owners, because the owner is what makes the list an accountability structure rather than a shopping list. The storage medium, the cost field, and the update frequency are all secondary to the owner requirement in this scenario.

9. B. Over-classification is the costly failure of a classification scheme: when everything is marked confidential, the label stops discriminating between real and routine sensitivity, and people stop respecting it. The document is over-protected in isolation (option A), but the scheme-wide erosion is the important consequence, and nothing here triggers a regulatory violation (option C).

10. B. Asset value for risk mathematics is the full business meaning of the asset: recreation cost, supported revenue, fines, and liability. Hardware retail price, license fees, and the original invoice (options A, C, and D) omit exactly the components that make the value relevant to SLE and ALE computations.

11. B. The owner decides classification and access; the custodian implements storage, labeling, and backup controls. The reversed pairings in the other options put decisions with the custodian and implementation or acceptance with the owner, which inverts the accountability line.

12. B. Reclassification, including downgrading, must be decided by the owner, documented for the audit trail, and communicated so the new class actually takes effect. It is not a custodian’s routine task (option A), and it does not require destroying labels or re-valuing the asset.

Asset inventory on one page

When the details blur, hold the machine. The inventory is the first control, and it is complete, current, and owner-bearing: every asset, uniquely identified, from acquisition to disposal, discovered continuously because shadow IT is the normal state of an ungated environment. The owner decides classification and access and answers for the asset; the custodian implements and operates; accountability never moves. Classification collapses data into a few handling regimes on two axes, sensitivity, the harm of disclosure, and criticality, the harm of outage, with governmental, commercial, and regulatory schemes, Executive Order 13526’s Confidential, Secret, and Top Secret; the organization’s own classes; and the PII, PHI, cardholder data, and GDPR special categories that law imposes on top. FIPS 199 gives the model: confidentiality, integrity, and availability each rated low, moderate, or high, with the high-water mark as the system’s category and control selection as its consequence. Valuation puts a number on the asset, the full business meaning, not the hardware, and that number feeds the SLE and ALE mathematics from Chapter 4. Every part of the machine ends in a decision someone can defend, which is the whole point of the domain.

Chapter 9 takes the regulatory categories this chapter named, PII, PHI, and the GDPR’s treatment of personal data, and builds the privacy program around them: the difference between privacy and confidentiality, the GDPR’s principles, and privacy impact assessment. Before you go, hold the one sentence that organizes this chapter: you can only protect, control, and value the assets you know you have, and the inventory, the owner, the class, and the value are the four answers to every asset security question.