A retailer is building its first data classification scheme. The information security manager must decide what should drive the sensitivity level assigned to each information asset. Which factor should primarily determine the classification level?
- AThe potential business impact if the asset's confidentiality, integrity, or availability were compromised Correct
- BThe storage format of the asset, such as whether it is held in a database, a spreadsheet, or a paper file
- CThe number of staff who currently request access to the asset during normal operations
- DThe age of the asset and how long it has been retained in the records management system
Why A is correct: Correct because classification reflects the value and sensitivity of the information, which is measured by the harm to the business if it were disclosed, altered, or made unavailable.
Why B is wrong: Tempting because storage format does affect some control choices, but format is a handling consideration that follows classification; it does not define how sensitive the information itself is.
Why C is wrong: Tempting because high demand can suggest importance, but access volume reflects operational convenience, not the inherent sensitivity that classification is meant to capture.
Why D is wrong: Tempting because retention schedules relate to data governance, but age alone does not set sensitivity; old records can be highly sensitive and new ones trivial.