The technology refresh project is in full swing, as is your group's efforts to identify an ITAM solution. However, as you have been looking into how to deploy an ITAM solution and classify the company's IT assets, you keep seeing the phrase "data classification" pop up. After a bit of digging you realize that not only does the company not classify its assets, but it doesn't classify its data either. You bring your concerns to the Team Lead and tell them that this is something that you think should be included in the project. The Team Lead is concerned about "scope creep" (as any good project manager should be), so they ask you to document your findings and justify why it should be made a part of the project.

paper that gives the Team Lead the information they've asked for.

The paper should include the following:

Definition, scope and benefits of data classification

How it could help the company from both a cost and compliance perspective

List specific compliance regimes such as Sarbanes-Oxley, export controls, and GDPR

Proposed classification categories and what they might include

Data retention: why it's important and how it might be implemented

Document and data destruction

How data classification would integrate with the new ITAM solution