ISC2 CISSP (Certified Information Systems Security Professional)Asset SecurityEasy
An organization is developing a new data classification scheme. They need to ensure that the scheme properly categorizes information based on its sensitivity and impact if compromised. Which of the following is the MOST appropriate first step in developing an effective data classification scheme?
- ATraining all employees on the new classification labels.
- BDefining the objectives and scope of the classification program.
- CImplementing technical controls for data loss prevention.
- DPurchasing new data storage solutions.
Show answer & explanationAnswer & explanation
Correct answer: B. Defining the objectives and scope of the classification program.
Before any other steps, it's crucial to define what the classification program aims to achieve and what assets it will cover. This foundational step ensures the scheme is relevant, comprehensive, and aligned with organizational goals.
Why the other options are wrong
- A. Training is a later step, after the scheme is defined and implemented.
- C. Implementing controls comes after classification and policy definition.
- D. Purchasing hardware is a tactical decision that comes much later in the process.
Data Classification Objectives
Clearly defined goals for a data classification program, including scope, purpose, and stakeholders, serving as the foundation for the entire scheme.
- Establishes 'why' and 'what' of classification.
- Aligns with business needs and risk tolerance.
- Guides subsequent steps in scheme development.
Memory trick: Goals first, then rules, then find the data, label, protect, and teach.