Security planning consists of three steps: assigning data owners and data classification, understanding how sensitive information is used, and developing a security strategy and controls design. In this article, we step through the initial planning step: data ownership and classification.