Patent ID: 8046819

Claim:
A method for determining security requirements for an information resource, using a computer system, the method comprising: determining, by the computer system, a privacy policy governing information maintained by the information resource; assigning, by the computer system, sensitivity levels to individual data elements based on user input; determining, by the computer system, a sensitivity level for the information resource based on the sensitivity levels of the individual data elements, the determined sensitivity level of the information resource corresponding to the highest sensitivity level of the individual data elements; assigning, by the computer system, the determined highest sensitivity level to the information resource to implement the privacy policy; determining, by the computer system, a criticality level associated with the information resource, the criticality level corresponding to an impact if the information resource were to become unavailable; and determining, by the computer system, security requirements for the information resource based on at least one of the determined sensitivity level and the criticality level to enforce the privacy policy governing the information maintained by the information resource; wherein the security requirements include at least one of baseline security requirements, mandatory security requirements, discretionary security requirements, and discretionary security requirements treated as mandatory; and wherein the baseline security requirements comprise security requirements to protect infrastructure.