This paper investigates how information classification is conducted in practice. Despite being a foundation of risk management work, information classification remains understudied from a practical perspective. This study uses semi-structured interviews and a small-scale experiment with professionals from a consultancy firm operating at a national level to explore how information assets are identified, valued and classified. The findings show that information classification is not a purely formalized process, but a collaborative and interpretative activity in which formal models are often adapted or bypassed in favor of context-specific reasoning. Key challenges in practice include inconsistent use of terminology, subjective judgments, and the limitations of classification schemes. The study highlights a need for a shared understanding and trust among participants, which were important factors for successful classification activities, especially in inter-organizational contexts. A three-step approach is thus proposed that emphasizes the value of information in organizational processes before assessing its protection needs. This new approach contributes to a more value-oriented understanding of assets instead of viewing them solely from the perspective of loss or damage. Future research could extend the findings presented.