The process of assessing the sensitivity or need for confidentiality of information and specifying the degree of protection to be afforded; or the specification of the level of protection to be afforded to particular data against fraudulent or improper access.