Abstract: Systems and methods for determining security requirements for an information resource may comprise determining a sensitivity level and a criticality level associated with the information resource. In addition, the systems and methods may include determining the security requirements for the information resource based on at least one of the sensitivity level and the criticality level. Moreover, the systems and methods may include determining a recovery time objective for the information resource and insuring that information used in determining the security requirements adheres to privacy requirements.