The company should really create procedures for categorizing and classifying all data, it does not matter where it resides. guidelines are needed to ensure that acceptable protections are in place though the data is at https://honeypotz.net