At the heart of all this is data classification. This should be the first step in any data protection strategy. Often this relies on humans participating in processes and this is where things start to become unstuck. Organizations are faced with asking themselves how to enforce accurate data classification of every artifact past and present, without causing all other processes to grind to a halt or become bankrupt.