# data[].attributes.headline
All information assets and systems must have an assigned owner.

# data[].attributes.subject
All information assets and systems must have an assigned owner.

# data[].attributes.headline
The Office of Information Security will maintain an inventory of information asset ownership.

# data[].attributes.subject
The Office of Information Security will maintain an inventory of information asset ownership.

# data[].attributes.headline
Owners are required to classify information and information systems in accordance with the organizational classification guidelines.

# data[].attributes.subject
Owners are required to classify information and information systems in accordance with the organizational classification guidelines.

# data[].attributes.headline
Owners are responsible for determining the required level of protection.

# data[].attributes.subject
Owners are responsible for determining the required level of protection.

# data[].attributes.headline
Owners must authorize internal information and information system access rights and permissions.

# data[].attributes.subject
Owners must authorize internal information and information system access rights and permissions.

# data[].attributes.headline
Implementation and maintenance of controls is the responsibility of the Office of Information Security; however, accountability will remain with the owner of the asset. 

# data[].attributes.subject
Implementation and maintenance of controls is the responsibility of the Office of Information Security; however, accountability will remain with the owner of the asset. 

# data[].attributes.headline
Owners must review and reauthorize access rights and permissions on an annual basis.

# data[].attributes.subject
Owners must review and reauthorize access rights and permissions on an annual basis.

# data[].attributes.headline
Owners must authorize third-party access to information or information systems. This includes information provided to a third party.

# data[].attributes.subject
Owners must authorize third-party access to information or information systems. This includes information provided to a third party.

# data[].attributes.headline
The company will use a four-tiered data classification schema consisting of protected, confidential, restricted, and public. 

# data[].attributes.subject
The company will use a four-tiered data classification schema consisting of protected, confidential, restricted, and public. 

# data[].attributes.headline
The criteria for each level will be maintained by and available from the Office of Information Security. 

# data[].attributes.subject
The criteria for each level will be maintained by and available from the Office of Information Security. 

# data[].attributes.headline
All information will be associated with one of the four data classifications. It is the responsibility of information owners to classify data.

# data[].attributes.subject
All information will be associated with one of the four data classifications. It is the responsibility of information owners to classify data.

# data[].attributes.headline
Information systems containing information from multiple classification levels shall be secured in accordance with the requirements of the highest classification level.

# data[].attributes.subject
Information systems containing information from multiple classification levels shall be secured in accordance with the requirements of the highest classification level.

# data[].attributes.headline
Data classification will remain in force regardless of the location or state of the data at any given time. This includes backup and archive media and locations.

# data[].attributes.subject
Data classification will remain in force regardless of the location or state of the data at any given time. This includes backup and archive media and locations.

# data[].attributes.headline
The classification system will allow that classifications of information assets may change over time.

# data[].attributes.subject
The classification system will allow that classifications of information assets may change over time.

# data[].attributes.headline
 Each classification shall have documented handling requirements.

# data[].attributes.subject
 Each classification shall have documented handling requirements.

# data[].attributes.headline
Each classification of data will have documented handling standards for the following categories: storage, transmission, communication, access, logging, retention, destruction, disposal, incident management, and breach notification.

# data[].attributes.subject
Each classification of data will have documented handling standards for the following categories: storage, transmission, communication, access, logging, retention, destruction, disposal, incident management, and breach notification.

# data[].attributes.headline
Each classification will have labeling requirements.

# data[].attributes.subject
Each classification will have labeling requirements.

# data[].attributes.headline
The Office of Information Security is responsible for the development and implementation of labeling and handling standards.

# data[].attributes.subject
The Office of Information Security is responsible for the development and implementation of labeling and handling standards.

# data[].attributes.headline
All employees, contractors, and affiliates will be provided or have access to written documentation that clearly describes the labeling and handling standards. 

# data[].attributes.subject
All employees, contractors, and affiliates will be provided or have access to written documentation that clearly describes the labeling and handling standards. 

# data[].attributes.headline
All employees, contractors, and affiliates will be provided with a resource that questions can be directed to. 

# data[].attributes.subject
All employees, contractors, and affiliates will be provided with a resource that questions can be directed to. 

# data[].attributes.headline
 All employees, contractors, and affiliates will be provided with a resource that violations can be reported to.

# data[].attributes.subject
 All employees, contractors, and affiliates will be provided with a resource that violations can be reported to.

# data[].attributes.headline
All information system assets shall be identified and documented with their classification, owner, location, and other details according to standards published by the Office of Information Security. 

# data[].attributes.subject
All information system assets shall be identified and documented with their classification, owner, location, and other details according to standards published by the Office of Information Security. 

# data[].attributes.headline
Company assets must be accounted for at all times. 

# data[].attributes.subject
Company assets must be accounted for at all times. 

# data[].attributes.headline
The Office of Information Security will maintain the inventory documentation.

# data[].attributes.subject
The Office of Information Security will maintain the inventory documentation.

# data[].attributes.headline
Copies of all inventory documentation will be included in the Business Continuity Plan.

# data[].attributes.subject
Copies of all inventory documentation will be included in the Business Continuity Plan.

# data[].attributes.headline
ISO 27002:2013 Section 8 Asset Management

# data[].attributes.subject
ISO 27002:2013 Section 8 Asset Management

# data[].attributes.headline
NIST SP 800-60 Guide for Mapping Types of Information and Information Systems to Security Categories 

# data[].attributes.subject
NIST SP 800-60 Guide for Mapping Types of Information and Information Systems to Security Categories 

# data[].attributes.headline
NIST SP 800-88 Guidelines for Media Sanitization 

# data[].attributes.subject
NIST SP 800-88 Guidelines for Media Sanitization 