{"text_format":"1","workbook":"xlsx","n_sheets":6,"sheets":["Overview","InformationAssetInventory","GAP Analysis","Guidelines","GAP Analysis 2011","MgmtSummary"],"not_rendered":{"charts":0,"images":4,"macros":1,"external_links":1,"defined_names":10,"comments":1,"pivot_tables":0},"unopened":[],"bounds":{"document_bytes":16777216,"sheet_cells":100000,"rows_first":2000,"rows_last":500,"rows_between":2000,"halvings":0,"cell_chars":16384,"cell_head_chars":4096},"cells_cut":0,"cells_raw":0,"read":"whole","date_system":"1900"}

{"sheet":"Overview","index":0,"n_rows":26,"n_cols":8,"rows_kept":26,"cut":false,"hidden":false,"merged":[[15,4,15,5],[17,7,21,11],[13,2,13,3],[15,2,15,3],[8,2,8,4],[1,5,1,10],[3,5,3,10],[4,5,4,10],[5,5,5,10],[25,1,25,12],[8,5,8,6],[8,9,8,11],[9,3,9,4],[9,7,9,8],[9,9,9,11],[14,2,14,3],[14,4,14,5],[14,7,14,10],[8,7,8,8],[10,7,10,8],[13,7,13,10],[10,9,10,11],[11,3,11,4],[13,4,13,5],[10,3,10,4]]}
[]
[null,null,null,null,null,"ISMS Information Asset Inventory Template "]
[]
[null,null,null,null,null,"Contributed to the ISO27k Toolkit by Steve McColl"]
[null,null,null,null,null,"secure-working.com"]
[]
[]
[]
[null,null,"Contents",null,null,"UPDATE",null,"Dept. Name(s):"]
[null,null,"0x01","Information Asset Inventory",null,null,null,"BISO:"]
[null,null,"0x02","Guidelines",null,null,null,"Date Completed:"]
[null,null,"0x03","Gap Analysis"]
[]
[null,null,"Business Name(s):",null,null,null,null,"Signed off by BISO and Business:"]
[null,null,"BISO:",null,null,null,null,"Date Signed Off:"]
[null,null,"Date Completed:"]
[]
[null,null,"Issue","Date","Purpose","Author(s)",null,"The above sign off indicates that the BISO has authorized the contents of this document once complete together with the business entity (e.g. with the M.D. or head of department).\n\nA record of this sign off will be available for auditing purposes."]
[null,null,"1.0","2008-07-25","Final ","Stephen McColl "]
[null,null,"1.1","2009-11-25","Updated Classification Types","Stephen McColl"]
[null,null,"1.2","2010-01-12","Updated classification types, added integrity and availability types, included managemement summary section.","Stephen McColl "]
[null,null,"1.3","2012-05-31","Modified in preparation for 2012 updates.","Stephen McColl"]
[]
[]
[null,"Copyright"]
[null,"This work is copyright © 2012, ISO27k Forum.  It is licensed under the Creative Commons Attribution-Noncommercial-Share Alike 3.0 License.  You are welcome to reproduce, circulate, use and create derivative works from this provided that (a) it is not sold or incorporated into a commercial product, (b) it is properly attributed to the ISO27k Forum at www.ISO27001security.com, and (c) if shared, derivative works are shared under the same terms as this."]

{"sheet":"InformationAssetInventory","index":1,"n_rows":242,"n_cols":20,"rows_kept":242,"cut":false,"hidden":false,"merged":[[1,15,1,16],[1,1,1,3],[1,4,1,13]]}
["Information Asset Inventory"]
[null,"Organisation & relevant process",null,null,"Information Asset Details",null,null,null,null,null,null,null,null,null,null,"Current Level of Protection",null,null,"BISO / TISO Assessment","BISO/Process Owner Action"]
["Nr","Operating Unit / Function ","Process name","Process owner","Name of Asset","Description of Asset","Type of Information Asset [Hard copy, Electronic File (specify type), removable media/device (specify type)]","Personal Data (Y/N)","Personal Sensitive Data (Y/N)","Sensitive Customer Data (Y/N)","Classification","Integrity","Availability","Asset Custodian\n(if NOT Functional Owner)","Data Retention Period","At Origin (description)","If Information is Moved (description)",null,"Security Conclusion","Process Owner Response and Date for Implementation (Evidence is required ie. screenshots or similar where applicable to prove these controls are enforced)"]
["Example","UNIT A","New starter process","Some One","New starter form","Form used to initiate the new starter process and sent to UNIT B via email.","Electronic .xls template file","Y","Y","N","Confidential","Medium","Low","UNIT B","0.5 Years","On PC of line manager, stored on network.  For some line managers, they store these files on their laptop.  Unlikely to be password protected.","Form is emailed to UNIT B using internal email system.  It is then held on System A and System B by UNIT B.",null,"It is thought that UNIT A operate on an different network to UNIT B and that emails are therefore routed via the external network.  There is therefore an issue that insecure personal sensitive data is being sent over the public internet. \n\nTISO Conclusion\nThis communication remains within the WAN. There is no data traversing public networks.\nSystem A and System B need to be subjected to a RAMM (Risk Assessment Management Methodology)"]
[1]
[2]
[3]
[4]
[5]
[6]
[7]
[8]
[9]
[10]
[11]
[12]
[13]
[14]
[15]
[16]
[17]
[18]
[19]
[20]
[26]
[28]
[29]
[30]
[31]
[32]
[33]
[34]
[35]
[36]
[37]
[38]
[39]
[40]
[41]
[42]
[43]
[44]
[45]
[46]
[47]
[48]
[49]
[50]
[51]
[52]
[53]
[54]
[55]
[56]
[57]
[58]
[59]
[60]
[61]
[62]
[63]
[64]
[65]
[66]
[67]
[68]
[69]
[70]
[71]
[72]
[73]
[74]
[75]
[76]
[77]
[78]
[79]
[80]
[81]
[82]
[83]
[84]
[85]
[86]
[87]
[88]
[89]
[90]
[91]
[92]
[93]
[94]
[95]
[96]
[97]
[98]
[99]
[100]
[101]
[102]
[103]
[104]
[105]
[106]
[107]
[108]
[109]
[110]
[111]
[112]
[113]
[114]
[115]
[116]
[117]
[118]
[119]
[120]
[121]
[122]
[123]
[124]
[125]
[126]
[127]
[128]
[129]
[130]
[131]
[132]
[133]
[134]
[135]
[136]
[137]
[138]
[139]
[140]
[141]
[142]
[143]
[144]
[145]
[146]
[147]
[148]
[149]
[150]
[151]
[152]
[153]
[154]
[155]
[156]
[157]
[158]
[159]
[160]
[161]
[162]
[163]
[164]
[165]
[166]
[167]
[168]
[169]
[170]
[171]
[172]
[173]
[174]
[175]
[176]
[177]
[178]
[179]
[180]
[181]
[182]
[183]
[184]
[185]
[186]
[187]
[188]
[189]
[190]
[191]
[192]
[193]
[194]
[195]
[196]
[197]
[198]
[199]
[200]
[201]
[202]
[203]
[204]
[205]
[206]
[207]
[208]
[209]
[210]
[211]
[212]
[213]
[214]
[215]
[216]
[217]
[218]
[219]
[220]
[221]
[222]
[223]
[224]
[225]
[226]
[227]
[228]
[229]
[230]
[231]
[232]
[233]
[234]
[235]
[236]
[237]
[238]
[239]
[240]
[241]
[242]
[243]
[244]

{"sheet":"GAP Analysis","index":2,"n_rows":4,"n_cols":20,"rows_kept":4,"cut":false,"hidden":false,"merged":[[1,1,1,3],[1,4,1,13],[1,15,1,16],[0,0,0,19]]}
["Once the Inventory is complete click the [Generate Gap Analysis] button below to highlight those information assets which require a risk assessment.\nYour risk assessment needs to verify that the protection controls in place for the assets listed are adequate to the sensitivity of the data as guided by the Information Handling Policy.\nUse <Columns S and T> to record necessary actions required of the process owner until complete. \n[DO NOT click GENERATE GAP ANALYSIS again unless you have created a copy of this document beforehand]"]
[null,"Organisation & relevant process",null,null,"Information Asset Details",null,null,null,null,null,null,null,null,null,null,"Current Level of Protection",null,null,"BISO / TISO Assessment","BISO/Process Owner Action"]
["Nr","1. Operating Unit / Function ","2. Process name","3. Process owner","4. Name of Asset","5. Description of Asset","7. Type of Information Asset [Hard copy, Electronic File (specify type), removable media/device (specify type)]","6. Personal Data (Y/N)","6.a Personal Sensitive Data (Y/N)","6. b Sensitive Customer Data (Y/N)","8. Classification","8.a Integrity","8.b Availability","9. Asset Custodian\n(if NOT Functional Owner)","10. Data Retention Period","10. At Origin (description)","11. If Information is Moved (description)",null,"Security Conclusion","Process Owner Response and Date for Implementation (Evidence is required ie. screenshots or similar where applicable to prove these controls are enforced)"]
[1,"Test1"]

{"sheet":"Guidelines","index":3,"n_rows":49,"n_cols":18,"rows_kept":49,"cut":false,"hidden":false,"merged":[[25,1,25,3],[19,4,19,8],[19,17,19,18],[20,17,20,18],[17,1,17,3],[25,4,25,18],[22,9,22,11],[22,12,22,16],[21,9,21,11],[18,17,18,18],[21,12,21,16],[19,9,19,11],[20,9,20,11],[20,12,20,16],[21,4,21,8],[26,17,26,18],[32,12,32,16],[33,1,33,19],[32,17,32,18],[32,1,32,3],[32,4,32,8],[29,9,29,11],[26,1,26,3],[26,4,26,8],[26,12,26,16],[27,1,27,3],[43,1,43,19],[22,1,22,3],[22,17,22,18],[22,4,22,8],[26,9,26,11],[24,17,24,18],[51,1,51,3],[50,4,50,8],[50,1,50,3],[48,1,48,3],[49,1,49,3],[46,1,46,3],[46,4,46,8],[23,12,23,16],[28,4,28,8],[27,17,27,18],[27,4,27,8],[28,9,28,11],[52,1,52,3],[48,4,48,8],[49,4,49,8],[51,4,51,8],[52,4,52,8],[24,12,24,16],[24,9,24,11],[23,1,23,3],[31,17,31,18],[31,1,31,3],[31,4,31,8],[29,12,29,16],[29,17,29,18],[23,4,23,8],[23,9,23,11],[28,17,28,18],[28,1,28,3],[31,12,31,16],[30,9,30,11],[30,12,30,16],[30,17,30,18],[31,9,31,11],[47,1,47,3],[47,4,47,8],[45,1,45,3],[45,4,45,8],[27,12,27,16],[28,12,28,16],[44,1,44,8],[27,9,27,11],[36,1,36,3],[35,9,35,17],[11,1,11,5],[16,1,16,19],[7,6,7,15],[21,1,21,3],[12,6,12,15],[29,1,29,3],[29,4,29,8],[24,4,24,8],[24,1,24,3],[23,17,23,18],[13,1,13,5],[19,12,19,16],[18,4,18,8],[18,1,18,3],[19,1,19,3],[18,9,18,11],[14,1,14,5],[15,1,15,5],[18,12,18,16],[17,4,17,18],[0,1,0,19],[4,1,4,5],[4,6,4,15],[1,1,1,15],[13,6,13,15],[14,6,14,15],[3,6,3,15],[5,6,5,15],[6,1,6,5],[7,1,7,5],[21,17,21,18],[8,1,8,5],[9,1,9,5],[10,1,10,5],[15,6,15,15],[12,1,12,5],[8,6,8,15],[9,6,9,15],[10,6,10,15],[11,6,11,15],[36,4,36,8],[34,1,34,3],[34,4,34,8],[34,9,34,17],[35,1,35,3],[35,4,35,8],[36,9,36,17],[32,9,32,11],[2,1,2,5],[2,6,2,15],[3,1,3,5],[5,1,5,5],[6,6,6,15],[20,1,20,3],[20,4,20,8],[30,1,30,3],[30,4,30,8],[39,1,39,3],[39,4,39,8],[39,9,39,17],[41,4,41,8],[41,9,41,17],[37,9,37,17],[42,1,42,3],[42,4,42,8],[42,9,42,17],[40,1,40,3],[40,4,40,8],[37,1,37,3],[37,4,37,8],[40,9,40,17],[41,1,41,3],[38,1,38,19]]}
[null,"Table 1- Process examples"]
[null,"Examples of processes and information assets"]
[null,"Generic Processes",null,null,null,null,"Information Asset"]
[null,"Core Business Processes",null,null,null,null,"Production data "]
[null,"Budget Process",null,null,null,null,"Budget Document, Invoices."]
[null,"HR",null,null,null,null,"CV, Salary letters, references, personal sensitive information, disciplinary information, pension information, starter mover joiner process."]
[null,"Resource Management",null,null,null,null,"Skills matrix, appraisals, training details i.e. records."]
[null,"Business Continuity",null,null,null,null,"BCP & DR Plans, BIA."]
[null,"Risk Management",null,null,null,null,"Risk Registers, Risk & Issues Logs."]
[null,"Audit",null,null,null,null,"SAS70 reports, any internal or external audit reports."]
[null,"Compliance",null,null,null,null,"Incident reports, money laundering reports, data protection information, all policies."]
[null,"Contracts",null,null,null,null,"Service agreements, Service definitions, contracts, SCRs, NDAs."]
[null,"Sales Collateral ",null,null,null,null,"Pricing information, RFIs, RFPs, presales leads (pipeline)."]
[null,"Reporting/Management Information/MIS",null,null,null,null,"Quality, Production, Sales definitions."]
[null,"Change management",null,null,null,null,"All project or related documentation."]
[null,"Project Management",null,null,null,null,"Project status reporting, customer reporting, internal project documents/specs."]
[null,"Table 2- Classification Types "]
[null,"Classification ",null,null,"Protection requirements for information in printed format."]
[null,"Usage",null,null,"Strictly Confidential",null,null,null,null,"Confidential",null,null,"Business use only",null,null,null,null,"Public "]
[null,"Labelling",null,null,"Each page to be marked STRICTLY CONFIDENTIAL.",null,null,null,null,"Each page to be marked CONFIDENTIAL.",null,null,"Each page to be marked Business use only.",null,null,null,null,"No security requirements."]
[null,"Addressing",null,null,"The storage medium must have two envelopes/layers of packaging.\nThe outer envelope/layer must:\n-Show the recipients name and address.\n-Be marked TO BE OPENED BY ADDRESSEE ONLY\n-Show the name and phone number of the sender of the information.\nThe inner envelope must be labelled STRICTLY CONFIDENTIAL.",null,null,null,null,"The storage medium must have two envelopes/layers of packaging.\nThe outer envelope/layer must:\n-Show the recipients name and address.\n-Be marked TO BE OPENED BY ADDRESSEE ONLY\n-Show the name and phone number of the sender of the information.\nThe inner envelope must be labelled CONFIDENTIAL. ",null,null,"Show the recipients name and address on envelope.",null,null,null,null,"Show the recipients name and address on envelope."]
[null,"Mailing of Information",null,null,"No classification marking on envelope; STRICTLY CONFIDENTIAL marking on cover sheet; confirmation of receipt at discretion of information owner.",null,null,null,null,"No classification marking on envelope; CONFIDENTIAL marking on cover sheet; confirmation of receipt at discretion.",null,null,"Mailing requirements determined by information owner.",null,null,null,null,"No security requirements."]
[null,"Storage",null,null,"Must be stored within secure fire and water proof locked storage units within a locked office. This includes single instance documents where no electronic or paper copies exist.",null,null,null,null,"Must be stored within locked storage units when not in the presence of the originator or recipient.",null,null,"Secure office or other location. Room need not be locked if access to the building or floor is restricted to employees and authorised non-employees. ",null,null,null,null,"No security requirements."]
[null,"Transportation",null,null,"By hand or approved courier.",null,null,null,null,"Registered mail.",null,null,"Normal mail service.",null,null,null,null,"Normal mail service."]
[null,"Disposal",null,null,"Information must be disposed of securely using cross-cut shredders or confidential waste bins which are certified for secure destruction.\nA record must be kept of how, when and by whom the information was destroyed (To provide an audit trail).",null,null,null,null,"Information must be disposed of securely using strip-cut shredders or confidential waste bins which are certified for secure destruction.",null,null,"Information must be disposed of securely using strip-cut shredders or confidential waste bins which are certified for secure destruction.",null,null,null,null,"Information which is deemed appropriate for public disclosure can be disposed of using locally supplied waste paper facilities. If there is any doubt as to whether the information is commercially or personally sensitive, then use strip-cut shredders or confidential waste bins which are certified for secure destruction."]
[null,"Classification ",null,null,"Protection requirements for information in electronic format (computer data)"]
[null,"Usage",null,null,"Strictly Confidential",null,null,null,null,"Confidential",null,null,"Business use only",null,null,null,null,"Public "]
[null,"Electronic Labelling",null,null,"The information medium must be marked STRICTLY CONFIDENTIAL on subject-line or header/footer.",null,null,null,null,"Where information medium is not permanently held in locked storage or a secure environment, it must be labeled CONFIDENTIAL on subject-line or header/footer.",null,null,"Must be marked Business use only on subject-line or header/footer.",null,null,null,null,"No security requirements."]
[null,"Transmission",null,null,"Information must be transmitted in encrypted form (using a business-approved method). Transmission should have controlled access e.g. password protected account login.",null,null,null,null,"Information must be transmitted in encrypted form (using a business-approved method). Transmissions should have controlled access e.g. password protected account login.",null,null,"Information should be transmitted to a verified account (eMail address or login ID).",null,null,null,null,"No security requirements."]
[null,"Storage (e.g. digital file, eMail or web page)",null,null,"Stored in a directory or folder with controlled access, e.g., password protection.\nInformation must be stored encrypted using approved methods.",null,null,null,null,"Stored in a directory or folder with controlled access, e.g., password protection. Information must be stored encrypted.",null,null,"Stored in a directory or folder with restricted access, e.g., password protection.",null,null,null,null,"No security requirements."]
[null,"Removable media (e.g. USB stick, CD, laptop, Blackberry)",null,null,"All removable media must have applied encryption including mobile devices e.g. Laptops, PDA’s, iPhones, Blackberries, USB Sticks. Laptop hard disks are to be encrypted and the laptop is to be secure to desks using e.g. Kensington locks.",null,null,null,null,"All removable media must have applied encryption including mobile devices e.g. Laptops, PDA’s, iPhones, Blackberries, USB Sticks. Laptop hard disks are to be encrypted and the laptop is to be secure to desks using e.g. Kensington locks.",null,null,"Secure office or other location. Room need not be locked if access to the floor is restricted to employees and authorised non-employees.",null,null,null,null,"No security requirements."]
[null,"Disposal of electronic information (digital file).",null,null,"In addition to removing the directory entry for the file, the space used by the file must be over-written using state of the art approved solutions for the permanent removal of data.",null,null,null,null,"In addition to removing the directory entry for the file, the space used by the file must be over-written using state of the art approved solutions for the permanent removal of data.",null,null,"Removal of Directory entry for file.",null,null,null,null,"Removal of Directory entry for file."]
[null,"Disposal of physical medium (e.g. hard disks/drives).",null,null,"Information must be disposed of securely using state of the art approved solutions for the permanent removal of data.\nA record must be kept of how, when and by whom the information was destroyed (to provide an audit trail).",null,null,null,null,"Media must be disposed of securely using state of the art approved solutions for the permanent removal of data (e.g. shredding or physical destruction).",null,null,"Media must be disposed of securely using state of the art approved solutions for the permanent removal of data (e.g. shredding or physical destruction).",null,null,null,null,"Media must be disposed of securely using state of the art approved solutions for the permanent removal of data (e.g. shredding or physical destruction)."]
[null,"Table 3- Integrity Types"]
[null,"Integrity level",null,null,"Definition",null,null,null,null,"Examples/impact of unauthorised modification"]
[null,"High",null,null,"100% error free.",null,null,null,null,"Same as Confidentiality classification for Strictly Confidential information."]
[null,"Medium",null,null,"96-99% error free.",null,null,null,null,"Same as Confidentiality classification for Confidential information."]
[null,"Low",null,null,"90-95% error free.",null,null,null,null,"Same as Confidentiality classification for Business use only information."]
[null,"Table 4- Availability Types"]
[null,"Availability level",null,null,"Definition",null,null,null,null,"Impact of unavailability"]
[null,"High",null,null,"No interruption beyond 0.5 days.",null,null,null,null,"Severe adverse impact."]
[null,"Medium",null,null,"No interruption of access beyond 1 day.",null,null,null,null,"Significant adverse impact."]
[null,"Low",null,null,"No interruption of access beyond 7 days.",null,null,null,null,"Limited adverse impact."]
[null,"Table 5- Sensitive data examples "]
[null,"Personal, Sensitive Personal, and Sensitive Customer Data"]
[null,"Information Asset Details",null,null,"Description"]
[null,"Personal Data",null,null,"An individual must be capable of being identified from that data or a number or sources of data\n- An example is a simple email address such as john.smith@company.com. We know that there is a company and that there is an individual called john smith who works for them so he can be identified from the email address, therefore the email address is enough to constitute personal information."]
[null,"Sensitive Personal Data",null,null,"Any data held either electronically or manually, which relates directly to a living individual and which covers specifically (including): racial or ethnic origin; political opinions; religious or other beliefs; Trade Union membership; health; sex life; criminal allegations, proceedings or convictions."]
[null,"Sensitive Customer Data",null,null,"Data which contains information specific to a customer including but not limited to bank account details, userids and passwords, list of employees."]

{"sheet":"GAP Analysis 2011","index":4,"n_rows":7,"n_cols":20,"rows_kept":7,"cut":false,"hidden":true,"merged":[[0,0,0,19],[1,1,1,3],[1,4,1,13],[1,15,1,16]]}
["Once the Inventory is complete click the [Generate Gap Analysis] button below to highlight those information assets which require a risk assessment.\nYour risk assessment needs to verify that the protection controls in place for the assets listed are adequate to the sensitivity of the data as guided by the Information Handling Policy.\nUse <Columns S and T> to record necessary actions required of the process owner until complete. \n[DO NOT click GENERATE GAP ANALYSIS again unless you have created a copy of this document beforehand]"]
[null,"Organisation & relevant process",null,null,"Information Asset Details",null,null,null,null,null,null,null,null,null,null,"Current Level of Protection",null,null,"BISO / TISO Assessment","BISO/Process Owner Action"]
["Nr","1. Operating Unit / Function (e.g. XIS, XBS, XCS, ISW, XHS etc..)","2. Process name","3. Process owner","4. Name of Asset","5. Description of Asset","7. Type of Information Asset [Hard copy, Electronic File (specify type), removable media/device (specify type)]","6. Personal Data (Y/N)","6.a Personal Sensitive Data (Y/N)","6. b Sensitive Customer Data (Y/N)","8. Classification","8.a Integrity","8.b Availability","9. Asset Custodian\n(if NOT Functional Owner)","10. Data Retention Period","10. At Origin (description)","11. If Information is Moved (description)",null,"Security Conclusion","Process Owner Response and Date for Implementation (Evidence is required ie. screenshots or similar where applicable to prove these controls are enforced)"]
[1,"Test1"]
[26,"XIS","SALES COLLATERAL","BPO/BUSINESS CHANGE","PRICING INFORMATION, RFI's ","ANALYSIS, TRACKING, PLANNING, HISTORICAL VIEW","EMAIL, PDF, XLS, WORD DOC","N","N","Y","Confidential","Medium","Medium","Business Change","Over 5 Years","REPOSITORY PASSWORD PROTECTED. ALSO ON SHARED DRIVE, PAPER COPIES SHREDDED AFTER USE","PAPER COPIES SHREDDED AFTER USE",null,"Security Control in place","No action"]
[28,"XIS","CHANGE MANAGEMENT","BPO/BUSINESS CHANGE","PROJECT DOCUMENTATION incl SCR","ANALYSIS, TRACKING, PLANNING","EMAIL, PDF, XLS, WORD DOC","N","N","Y","Business use only","Medium","Medium","Business Change","Over 5 Years","REPOSITORY PASSWORD PROTECTED. ALSO ON SHARED DRIVE, PAPER COPIES SHREDDED AFTER USE","PAPER COPIES SHREDDED AFTER USE",null,"Security Control in place","No action"]
[29,"XIS","PROJECT MANAGEMENT","BPO/BUSINESS CHANGE","PROJECT STATUS REPORTS","ANALYSIS, TRACKING, PLANNING","EMAIL, PDF, XLS, WORD DOC","N","N","Y","Business use only","Medium","Medium","Business Change","Over 5 Years","REPOSITORY PASSWORD PROTECTED. ALSO ON SHARED DRIVE, PAPER COPIES SHREDDED AFTER USE","PAPER COPIES SHREDDED AFTER USE",null,"Security Control in place","No action"]

{"sheet":"MgmtSummary","index":5,"n_rows":11,"n_cols":2,"rows_kept":11,"cut":false,"hidden":true,"merged":[[10,0,10,6],[11,0,11,6],[14,0,14,6],[12,0,12,6],[13,0,13,6]]}
["Status Report"]
[]
["Classification Type Summary "]
["Classification Type","Total"]
["Strictly Confidential",{"$f":"COUNTIF(InformationAssetInventory!#REF!,\"Strictly Confidential\")","v":{"$error":"#REF!"}}]
["Confidential",{"$f":"COUNTIF(InformationAssetInventory!#REF!,\"Confidential\")","v":{"$error":"#REF!"}}]
["Business Use Only",{"$f":"COUNTIF(InformationAssetInventory!#REF!,\"Business use only\")","v":{"$error":"#REF!"}}]
["Public",{"$f":"COUNTIF(InformationAssetInventory!#REF!,\"Public\")","v":{"$error":"#REF!"}}]
[]
["Management Summary"]
["[Complete after review and distribute]"]