Conduct an inventory of all data that require protection, maintain an up-to-date inventory of sensitive records and data systems, and classify data by sensitivity
22
