Asset classification and control in information assurance