We're interested in implementing a data-classification program to lower our compliance costs. We'd like to establish different sets of controls for different data types. However, we're struggling to define our data-classification levels. How do you recommend structuring the data-classification scheme for a Fortune-500-type company?