Information retention policies are the most important to review, because they define the rules and procedures for retaining, disposing, and destroying information in accordance with the legal, regulatory, and business requirements. Information retention policies can help the enterprise to comply with the personal data protection regulations, and to ensure the privacy, security, and availability of the employee data in production systems12. References := ISACA, CGEIT Review Manual, 7th Edition, 2019, page 57-58.

The impact of information exposure is the most important factor for an enterprise to review when classifying information assets, because it helps to determine the level of sensitivity and protection that the information assets require. Information assets are classified according to their confidentiality, integrity, and availability, which reflect the potential harm or loss that could result from unauthorized disclosure, modification, or destruction of the information assets. The impact of information exposure can be assessed in terms of financial, reputational, legal, operational, or strategic consequences for the enterprise and its stakeholders. The impact of information exposure can also vary depending on the context, scope, and duration of the exposure. Therefore, by reviewing the impact of information exposure, an enterprise can assign appropriate labels and controls to its information assets, and ensure that they are handled and stored securely and appropriately. Reference:= Information classification according to ISO 27001, Information Asset and Security Classification Procedure, Information Classification Standard.