Experienced security vendors will review an organization’s strategic objectives and operational processes to identify levels of business risk. Then, critical information assets are defined based on their significance to the business, their value to an attacker and their associated business impact if they were to be compromised.