Abstract: Systems and methods for determining security requirements for an information resource may comprise determining a sensitivity level and a criticality level associated with the information resource. In addition, the systems and methods may include determining the security requirements for the information resource based on at least one of the sensitivity level and the criticality level. Moreover, the systems and methods may include determining a recovery time objective for the information resource and insuring that information used in determining the security requirements adheres to privacy requirements. The sensitivity level may be derived from privacy requirements of information maintained by the information resource. For example, the sensitivity level and resulting security requirements may be based on a need to meet privacy requirements by protecting confidentiality or integrity of the information resource.

Abstract: A privacy impact assessment is performed to determine and implement privacy requirements for any information resource that uses personal information. Data may be collected and analyzed regarding the information resource and the personal information, and applicable laws, regulations, and policies may be considered to determine privacy requirements. Such requirements may include, for example, access controls, information retention periods, systems requirements, and risk assessments.