When deciding to develop a system with sensitive data, which of the following is MOST important to include in a business case?

For systems handling sensitive data, the most important inclusion in a business case is a comprehensive risk assessment. This identifies potential threats and vulnerabilities to the sensitive information, allowing for the determination and justification of necessary security controls, thereby demonstrating due diligence and mitigating potential legal, financial, and reputational risks.

While an updated enterprise architecture (EA) might be affected by a new system, it is not the most critical element directly addressing the inherent risks of handling sensitive data in the business case.

A skills gap analysis is important for project staffing and planning, but it does not directly address the fundamental security and protection requirements for sensitive data within the business case.

The additional cost of encrypting sensitive data is an important financial consideration, but it stems from the findings of a risk assessment that dictates the necessity and extent of such controls, making the assessment itself more fundamental.