Answer
Classify data based on sensitivity and consequence, then apply storage, access, sharing, retention, and monitoring controls that fit that classification.
Explanation
Different missions create different security exposure. Controls should follow the data's value and sensitivity, not merely the file type.