A project team is building an internal analytics platform that will ingest customer records, employee HR files, and publicly available marketing content. Before storage architecture decisions are finalized, the project manager wants to ensure each type of information receives the appropriate level of encryption, access control, and retention handling. Which organizational governance artifact should the team consult FIRST to determine how each data type must be protected?