1. For each asset shown in a network diagram, write 1-2 paragraphs describing what the asset is, where the asset is used, and how
2. Determine a significance level (high, medium, low) for each organization asset based on confidentiality, integrity, and availability and add the asset to the respective grouping in the table.
3. Classify each information asset by category (Tier 0, Tier 1, Tier 2, and Significant Systems) and place the asset in the respective grouping based on the level of sensitivity for the associated data to denote the impact of the loss of that asset, related data, or functionality would have.
4. Create a second table that shows the following information for each asset:

• Owner of asset, role, and responsibility
• Data policy (Yes/No) and information asset security management policy (Yes/No)
• Data governance (Yes/No) - (data is protected under the statute, contract, or compliance/regulatory bodies)

1. Create a third table that shows the following information:

• Inventory of software applications
• Current list of known vulnerabilities
• Prioritization of each vulnerability by risk level
• Application patch level (from software vendor if known)
• Actions to patch or apply alternative control