Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
ISACA Certified Information Systems Auditor · Isaca
Select one answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
When classifying information, the primary goal is to ensure that the level of protection assigned to the data reflects its value and sensitivity to the organization. Therefore, classification should be based on business risk — including the potential impact of data disclosure, alteration, or loss. Why not the others? B. Data retention requirements Retention is a complementary consideration, but it does not drive classification. C. Industry standards These provide guidance, but may not fully align with the specific risks and needs of the organization. D. Security policy The security policy should be based on the classification, not the other way around. Policies enforce classification schemes, not define them.
A. business risk. This ensures that the classification reflects the potential impact of data loss or exposure on the organization, prioritizing protection based on the actual risks faced.
A, based oncriticality