A security administrator is working with the human resources department to classify data held by the company. The administrator has determined the data contains a variety of data types, including health information, employee names and address, trade secrets, and confidential customer information. Which of the following should the security administrator do NEXT?

1. Apply a predefined set of labels from government sources to all data within the company.
2. Create a custom set of data labels to group the data by sensitivity and protection requirements.
3. Label sensitive data according to age to comply with retention policies.
4. Destroy company information that is not labeled in compliance with government regulations and laws.