12556 evsjv‡`k †M‡RU, AwZwi³, GwcÖj 6, 2014 the owner as deemed appropriate but the owner remains responsible for the proper protection of the information assets. One of the very important obligations for any agency is not to outsource the responsibility of their information, i.e. responsibility for the security of information assets should be kept always within the agency owning that. (16) Archiving of Information Asset Continuous accumulation of information will be voluminous and may go beyond the manageable limit resulting difficulties in handling information for its optimum utilization. Therefore obsolete, duplicate, redundant and unnecessary information may be destroyed or archived. While destroying any information an agency must get proper approval from information owner and custodian for destroying, and they must maintain a log mentioning reason for destruction. In case of archival, similar to archival of paper and files, an agency must consider archival of electronic information asset. Depending on the importance of information asset agency may define retention period of information asset. An agency must follow Section 9 of ICT Act 2006 and other relevant law before defining the retention period of electronic information. (17) Actions according to this Section The tasks defined throughout section 7, are the prior tasks of an agency that should be structured properly in their Information Security Policy. As a whole, this is called information gathering and information asset management. Steps towards accomplishing this include: (a) Information classification and state Information should be analyzed and classified in terms of its value, legal requirements, sensitivity, and criticality to the organization. After classification, the states of those classified information must also be defined. (b) Inventory of Information assets All information assets should be clearly identified and an inventory of all important assets should be drawn up and maintained. An agency should identify all assets and document the importance of these assets. The asset inventory should include all information necessary in order to recover from a disaster, including type of asset, format, location, backup information, license information, and a business value. The inventory should not duplicate other inventories unnecessarily, but it should be ensured that the content is aligned.