The technology refresh project is in full swing, as are your group's efforts to identify an ITAM solution. However, as you have been looking into how to deploy an ITAM solution and classify the company's IT assets, you keep seeing the phrase "data classification pop up.

After a bit of digging you realize that not only does the company not classify its assets, but it doesn't classify its data either. You bring your concerns to the Team Lead and tell them that this is something that you think should be included in the project. The Team Lead is concerned about "scope creep" (as any good project manager should be), so they ask you to document your findings and justify why it should be made a part of the project. The paper should include the following:

● Definition, scope, and benefits of data classification

● How it could help the company from both a cost and compliance perspective ○ List specific compliance regimes such as Sarbanes-Oxley, export controls, and GDPR   (Explain that)

● Proposed classification categories and what they might include

● Data retention: why it's important and how it might be implemented

● Document and data destruction

● How data classification would integrate with the new ITAM solution