Use business goals to scope your program

There are 3 things that can happen to your critical data, from a security perspective.

Your data can be disclosed, corrupted, or denied of access.

Let's say you want to close 10 deals over the next quarter. To achieve that goal, you will use computers to access all kinds of data. It might be customer information, financials, or contracts. It might be historical records, a list of some sort, or maybe a piece of code.

If your mission depends on it, add it to the scope.