Must initially determine what level of damage would occur to information if unauthorized disclosure of that information occurred