An organization wants to adopt a labeling system based on the value, sensitivity, and criticality of the information. What element of risk management is recommended?