The reason we conduct security assessments as part of developing a functional/relevant security program is to generate value to the stakeholders by ensuring that the identified risks to the BUSINESS are optimized and we are left with residuals . Other answers are tactical .As a cybersecurity leaders you must turn tactical observations into strategic insights but first must find out what business process / function is the cash cow or star player and then identify the assets , data etc that enable it and then get tactical and geek out with your security toys .

As the name implies, the Mandatory Access Control defines an imposed access control level. MAC is defined as follows in the Handbook of Information Security Management: With mandatory controls, only administrators and not owners of resources may make decisions that bear on or derive from policy. Only an administrator may change the category of a resource, and no one may grant a right of access that is explicitly forbidden in the access control policy.

The *- (star) property of the Bell-LaPadula access control model states that writing of information by a subject at a higher level of sensitivity to an object at a lower level of sensitivity is not permitted (no write down).
Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley & Sons, 2001, Chapter 5: Security Architectures and Models (page 202). Also check out: HARRIS, Shon, All-In-One CISSP Certification Exam Guide, McGraw-Hill/Osborne, 2002, Chapter 5: Security Models and Architecture (page 242, 243).

Life safety, or protecting the health and safety of everyone in the
facility is the first priority in an emergency or disaster. Evacuation
routes, assembly areas, and accounting for personnel (head counts
and last-known locations) are the most important function of emergency
procedures, before anything else. Once all personnel have been
accounted for and emergency teams have arrived to prevent further
damage or hazard, family members should be notified of the status of
the event. Providing restoration and recovery, and implementing
alternative production methods also comes later. Source: Emergency
Management Guide for Business and Industry, Federal Emergency
Management Agency, August, 1998.