Different industries have different types of sensitive data they maintain. This data can include personal health information (PHI), personally identifiable information (PII), trade secrets, national security secrets, credit card numbers, bank account numbers, passwords, etc. These sensitive pieces of information can be stored in structured databases, structured files, unstructured files, or unstructured data stores. The following four items:

1. Pick a distinct industry: banking, finance, retail, healthcare, national security, etc.
2. Describe the types of sensitive information that an organization in that industry may maintain.
3. Describe keywords, document types, regular expressions, or other indicators that could identify where sensitive information is stored and when it is sent over the network, email, web, or transferred via an application on the endpoint.