Assigning value to the information that has been analyzed is a key final step to building the information security protection needed for your organization. Assigning a value to your organization's information will allow you to best decide how much money the organization should commit to protecting that information.

Example questions for assigning value to information are as follows:

• Consider the regulatory and compliance requirements for a certain information asset:
  • Are there specific fines?
  • Could a contract be lost?
• Consider what would happen to your organization if the data was to be lost, stolen, or modified:
  • What did it cost to develop the information or capability?
  • What is the impact of having another competitor?