Information must be protected in a manner commensurate with its sensitivity, value and criticality. This policy applies regardless of the media on which information is stored, the locations where the information is stored, they system used to process the information, or the processes by which information is handled.