What does my organization have that is worth protecting?

Information security is not about implementing new information security tools. It is about protecting your organization's sensitive information assets. As an information security professional, you must determine what is important to your organization so that you can prioritize your security activities.