Which data is actually at risk

The main criterion is how long confidentiality must be preserved. At risk: IP, defense data, medical records, long-term financial/legal docs, strategic plans. Low or no HNDL relevance: short-lived sessions, OTPs, public data. Data classification is mandatory to assess HNDL exposure.