In the system characterization phase the information security manager is tasked to identify and list all assets which require protection. What constitutes an asset is not necessarily clear. We argue that relevant assets need to be deserving of protection, meaning they must have a value attached to them which may be inflicted if an attack was to be successfully launched. [7] also add the inclusion of accepted risks levels in the asset identification process.