- Do you have a system for information classification?
- Do you have a set of procedures for information labelling and handling, in accordance with the classification scheme?
- Do you allow the use of personal removable data storage devices?
- Is there a formal documented asset management program in place?
- Do you maintain a complete inventory of all of your critical assets located at all sites/ or geographical locations and their assigned ownership?