RE: Info Classification Project Scoping

my .2 cents...
I'd  get the data owners involved in the overall Information object
classification.
I'll provide guidance that may be in classification categories (public,
restricted etc) and value (none to highly critical).
The largest hurdle is getting time from business units and coordinating the
information gathering.
So the scope would include:
Identification of information owners
Interviews with all the information owners
Provide classifications and value
Project management
Document that puts it all together.
HTH


Regards,
 
Gary Everekyan
CISSP, CISM, ISSAP,ISSPCS, MCSE, MCT
Information Security and Audit
"High achievement always takes place in the framework of high expectation" -
Jack Kinder

 

-----Original Message-----
From: Renato Ferro [mailto:renato.ferro@gmail.com] 
Sent: Monday, June 20, 2005 12:38 PM
To: security-management@securityfocus.com
Subject: Info Classification Project Scoping

Dear Security Managers,
What is the best approach in order to compose a scope for a very large
organization information classification project.

Scoping the project by systems and applications, departments, business
units, mainframe or distributed systems? etc.

Any opinions would be helpful.

Thanks,