12552 evsjv‡`k †M‡RU, AwZwi³, GwcÖj 6, 2014 (2) Definition of Information Information is an asset that, like other important business assets, is essential to an organization’s business and consequently be appropriately safe guarded. Broadly defined Information is the basis on which the agency conducts their business. Reliable information supports business capabilities, notably by enabling good decision making. The Government holds information that is operationally, administratively, politically, commercially or personally significant. The government has a fundamental ‘duty of care’ and legal obligations to protect this information from unauthorized or accidental modification, loss/damages or release. There are moral and ethical considerations in the appropriate handling of information as well. (3) Information can be in any form. It includes: a. documents and papers; b. electronic data; c. the systems (software, hardware and networks) on which the information is stored, processed or communicated; d. intellectual information (knowledge or perceptions) acquired by individuals; e. physical items from which information regarding design, components or use could be derived; and f. Images, audio or video clips. (4) Definition of Information Asset Asset is anything that has a value to the organization, agency or nation. Information is a key asset for an organization. Asset must be kept under protection for ensuring trust among stakeholders who use and own the asset. Asset is very much related to security risks assessment. The first step in assessing security risks is to take stock of enterprise’s information assets (e.g. application programs, stored data, reports, product designs and specifications, proposals, business plans, financial records, databases, and other files and documents residing on your organization’s computer systems). The objective is to organize the assets, conceptually, into appropriate categories, to help understand them and their boundaries. It is necessary to determine the appropriate owners of the various assets and convince them to take responsibility for evaluating their importance and value. (5) Asset must be classified for assigning access to that asset. Once the information resources have been identified and developed with appropriate ways of classifying and understanding their perimeters, the next step is to define who