The threat model for information stored locally, within network perimeters, is different that of information shared in collaborative, deperimeterised environments. The former allows an organisation to control access to information within a secured perimeter for a specified set of users, while the latter allows information “into the wild” where there is no perimeter in which to enforce access control and no finite set of users to control access for.

It is therefore essential that information is correctly and accurately classified to identify the organisations and individuals that should have access to it as well as the data handling requirements such as secure storage and safe disposal that are relevant to the information content.