Has your organization established and documented criteria for prioritizing different classes of assets based on their criticality and value?

This question assesses whether your organization has a formal methodology for categorizing and prioritizing assets (such as data, systems, applications, and infrastructure) according to their importance to business operations, sensitivity of information, and potential impact if compromised. Effective asset prioritization helps allocate security resources appropriately and ensures that the most critical assets receive proportionate protection measures.As evidence, you could provide a documented asset classification framework that defines criteria for prioritization (e.g., business impact, regulatory requirements, replacement cost, data sensitivity), along with a sample asset inventory showing how these criteria have been applied to categorize existing assets.