When gathering security requirements for an automated business process improvement program, which of the following is MOST important?

Question

Options

• AType of computer the data s processed on
• BType of data contained in the process and system
• CType of connection and protocol used to transfer the data
• DType of encryption required for the data once it is at rest

• A
  7% (4)
• B
  76% (45)
• C
  3% (2)
• D
  14% (8)

Explanation

Option B is correct because the type of data in a process is the foundational driver of all other security decisions - regulatory requirements (PCI, HIPAA, GDPR), classification levels, and the controls needed all flow from what data is being handled. Without knowing what data is involved, you cannot meaningfully determine any other security requirement.

Why the distractors fall short:

• A (type of computer): Hardware platform is largely irrelevant to requirements gathering; security controls must protect the data regardless of what machine processes it.
• C (connection/protocol): Transport security matters, but it's a derived requirement - you first need to know the data sensitivity before deciding whether TLS 1.3, VPN, or an air gap is needed.
• D (encryption at rest): Also a derived requirement; the encryption standard you choose depends on the data classification, not the other way around.

Memory tip: Think "data first, controls second." In security requirements, the nature of the data is always the anchor - every other control (encryption, protocols, hardware) is determined after you know what you're protecting and why.

No community discussion yet for this question.