All information assets are assessed in line with CPSsensitivity and criticality of an information asset and upon classification outcomes appropriate NIST and industry best practice security controls are implemented and validated for effectiveness through various assessment activities.