An asset-centric approach involves identifying the assets of an organization entrusted to a system or software, (i.e.), data processed by the software. Assets are classified according to data sensitivity and their intrinsic value to a potential attacker, in order to prioritize risk levels.