Reference no: EM133712916

Problem

The first major step in any risk management framework is to categorize information systems. An information security professional must understand the sensitivity of the data an information system processes and stores before categorizing an information system. It is important for the information security professional to understand the sensitivity (Low, Medium, High) of the organization's data elements to ensure the protection of the confidentiality, integrity, and availability of the data. For example, data categories and data elements that apply to a hospital environment include patient health information (PHI), personal identification information (PII), payment card industry (PCI), to name a few. There are elements within each data category, such as patient name, surgical procedure, prescription information, etc. that make up the PHI data category. List at least 2 data categories and at least three data elements within each category for a typical financial institution (e.g., bank, savings and loan, etc.). Use this reading "Minimum Security Requirements for Federal Information and Information Systems" as a guide to map each element to a sensitivity level (Low, Medium, High) for Confidentiality, Integrity, and Availability. Explain why this identification is important for the risk management framework.