Security threats is a problem frequently faced by various organizations today. We must consider not only the countermeasures to avoid attacks, but also how to eliminate the remaining risks being concealed. We previously proposed an assessment system that estimates resource importance in the organization to assess the residual risks of information leakage. Although an organization stores various resources including data from its customers, the system only took data originated from the organization into account. This paper discusses the improvement for the previous method based on data lineage and access authority.