What should an organization's data and asset classification be based on?

Data and asset classification should be based on the sensitivity of data, which is the degree to which the data requires protection from unauthorized access, modification, or disclosure. Data sensitivity is determined by the potential impact of data loss, theft, or corruption on the organization, its customers, and its partners. Data sensitivity can also be influenced by legal, regulatory, and contractual obligations.

References =

Certificate of Competence in Zero Trust (CCZT) prepkit, page 10, section 2.1.1

Identify and protect sensitive business data with Zero Trust, section 1

Secure data with Zero Trust, section 1

SP 800-207, Zero Trust Architecture, page 9, section 3.2.1