The Asset Library Nobody Includes in the Security Review

Security teams map their data thoroughly. Customer records, financial systems, source code repositories, HR files: all identified, classified and controlled. Then there is the marketing team's shared drive containing forty thousand images, video files, product photographs and campaign material, accessed by two agencies, six freelancers and everyone who has ever worked in the department.

It rarely appears on a data inventory, it almost never features in an access review, and it is treated as though media were somehow not data at all.