Case Analysis –

Asset Security
Answer the following:
1. Network Firewalls division has a lot of information that is created and maintained. However,
Kevin, a Security Administrator at Nutri Worldwide Inc., recognizes that not all the information
is critical, and would like to do a high-level classification of the information accessible to him.
Question: What are the different information classification levels Kevin has to use?
Commercial or Private Sector Classification
Government or Military Sector Classification

2. With the rapid expansion in the collection and storage of digitized personal information of
customers at Nutri Worldwide Inc., the issue of privacy has gained significance.
As the General Manager of IT security, Hilda Jacobs is concerned as there are very stringent
legal and regulatory requirements for the protection of privacy and data. She decides to
implement a data management process in the organization.
Question: What is the first step Hilda must undertake to kick-start the data management
process at Nutri World Inc.?
Create a data management policy which will guide the overall data
management program in the organization.

3. Hilda Jacobs, General Manager – IT Security at Nutri Worldwide Inc., was given the
responsibility of selecting appropriate data security controls as part of asset security.
Hilda selected the controls according to the organization's different requirements for the data
at rest and data in transit based on the existing risk. She also created a best practices
document by referring to available standards for data security.
Question: For implementing Information Security Management System, Hilda Jacobs
should refer to which standard?
ISO/IEC 27001