Establish an appropriate classification based on the sensitivity of the information in question. Information should be classified in terms of the damage that unauthorized disclosure would cause the organization. This will help to increase the focus on the value of the information by considering the impact or damage likely to occur if information was disclosed.