I first started talking about data here. Continuing the thought process, I think the aim should be to start out simply. Data classifications and data categories can be a rather daunting task. That is probably why many businesses don’t do it all. But, if you are starting out in a new business, take some time to build it in.
Sometimes I sit back and wonder what it would be like if I could implement information security right from the beginning of a new business. What would I do? Would I remember the lessons learned over the years? A hard thing to remember, even today, is to keep in the forefront what INFOSEC should be about. It’s more than using technology. It’s more than the people. It’s about the data.