For example, an organization may estimate that it is experiencing significant losses in inventory through fraudulent manipulation of its systems. Furthermore, access control implemented via secure operating procedures or other administrative controls may prove to be more cost effective than a technical access control solution. The costs and benefits of security should be carefully examined in both monetary and non-monetary terms to ensure that the cost of controls does not exceed expected benefits . One can, however, decrease risks in proportion to the strength of the protective measures used. As determined by appropriate cost vs. risk and cost vs. benefit assessments, the level of security is based on the value of the information .
Sensitive data is any data that is worth protecting.
The exact sensitivity and precise protections may be unique to each business environment. Within most organizations, there will be varying levels of sensitive information. Each SESA is encouraged to evaluate the policy, standards, and guidelines to determine whether more stringent requirements are necessary given the individual agency's authority and function. The following reports can be used as starting points to determine laws that may be relevant in your state, including laws on UI Fraud.