Which of the following will provide the MOST guidance when deciding the level of protection for an information asset?