Now that you have determined what your organization's information assets are and where they are located within your organization's information system you can now begin the process of further categorizing the information.

The purpose behind this step is to place the information that you have identified into categories that will help the business and IT organization build information security controls for the protection of this information.