An engineer is evaluating the control profile to assign to a system containing PII, financial, and proprietary data. Based on the data classification table above, which of the following BEST…

High availability would apply to systems where downtime causes immediate operational or safety impact; a data store for PII and financial records does not meet that threshold under standard data classification frameworks.

PII, financial, and proprietary data carry strict regulatory obligations such as GDPR and PCI-DSS that mandate strong access controls, encryption, and breach notification, placing confidentiality at the high level. Availability is classified as medium because data integrity and confidentiality take precedence and the workloads do not require the continuous uptime associated with critical infrastructure or life-safety systems.

Low confidentiality is incompatible with PII and financial data, which are subject to regulatory controls specifically because of their high sensitivity.

While data integrity is important for financial records, assigning low availability is inconsistent with business requirements for a system holding PII and financial data, and the classification does not reflect the primary driver of high confidentiality.