Tip! 
In the first pass, an organization is identifying the types of information stored.  Later in the assessment, one is able to identify which specific tools and services contain the designated information.  This will provide a roadmap and narrow the focus for the assessor.

Tip!  While you may recognize many categories, if your organization is going to undergo a 3rd party assessment or audit, you may want to limit the list to those categories that are in scope for the cybersecurity assessor.  Selecting additional categories opens the door to more questions from the assessor.

Review all of the available categories with are sourced from the National Archives Registry.  Defense contractors usually focus on the "Defense" section.  

If you aren't sure about a category's official definition, use the icon to open a window to the NARA site with the official details.

Click "Controlled Technical Information means technical information with military or space application that is subject to controls on the access, use, ..."

Controlled Technical Information means technical information with military or space application that is subject to controls on the access, use, reproduction, modification, performance, display, release, disclosure, or dissemination. Controlled technical information is to be marked with one of the distribution statements B through F, in accordance with Department of Defense Instruction 5230.24, "Distribution Statements of Technical Documents." The term does not include information that is lawfully publicly available without restrictions. "Technical Information" means technical data or computer software, as those terms are defined in Defense Federal Acquisition Regulation Supplement clause 252.227-7013, "Rights in Technical Data - Noncommercial Items" (48 CFR 252.227-7013). Examples of technical information include research and engineering data, engineering drawings, and associated lists, specifications, standards, process sheets, manuals, technical reports, technical orders, catalog-item identifications, data sets, studies and analyses and related information, and computer software executable code and source code.

app.futurefeed.co

archives.gov

In order to protect something, one must know what they are protecting.  Whether the target is CUI (Controlled Unclassified Information), FCI (non-public Federal Contract Information), or sensitive commercial data, an early step is to identify the various types of data in the organization's "inventory."

Identifying CUI, FCI and Sensitive Data - First Pass