CRISC: Certified in Risk and Information Systems ControlDemo

By Isaca · Question Mode

QuestionQ257

Governance

Before assigning sensitivity levels to information, what is MOST important to do?

  • A define the information classification policy.
  • B conduct a sensitivity analysis.
  • C identify information custodians.
  • D define recovery time objectives (RTOs).
Explanation

An information classification policy establishes the categories, criteria, handling requirements, and responsibilities used to label information consistently. It must be defined before sensitivity levels can be assigned.

Community Discussion

No comments yet. Be the first to start the discussion!