Risks of Data Lost and Found Activity: Have rank the impact if different data within the organization was lost, and if adversaries gained access to that data. Private Data Activity: Guide staff through an activity to have them list private data within the organization 65 If it was not possible to conduct these activities in person, you can conduct them remotely through applying one of the remote facilitation approaches described in the Remote Facilitation appendix. OUTPUTS A map of the staff's understanding of critical organizational data: what that data is, where it is stored, who has access, who needs access. OPERATIONAL SECURITY Ensure that any physical notes/drawings are erased and destroyed once digitally recorded. Ensure that any digital recordings of this process are kept secure and encrypted. Consider who has physical and visual access to the room where this process takes place, and if the room can be secured if this activity may span long/overnight breaks. PREPARATION Facilitation skills or experience is useful for these exercises Carefully review the exercises you plan to use RESOURCES Activity: "Backup Matrix: Creating an Information Map"(LevelUp) Activity: "Identifying and prioritizing your organization’s information types " (NISTIR 7621) Guide: "Data Risk Checker: Categorizing harm levels on knowledge assets to inform mitigation and protection" (Responsible Data Forum wiki) Guide: "Awareness and Training" (Information Security Handbook: A Guide for Managers - NIST 800-100) Guide: "Managing Information Security Risk: Organization, Mission, and Information System View" (NIST 800-39) Guide: "Guide to Protecting the Confidentiality of Personally Identifiable Information (PII)" (NIST 800-122) Page 104 of 240