Which of the following would be MOST helpful to an enterprise that wants to standardize how sensitive corporate data is handled?

An information classification framework establishes categories (e.g., public, internal, confidential) and defines specific handling requirements for each, ensuring consistent protection levels across the enterprise. By clearly defining data types and associated controls, it allows for the standardization of security measures, access controls, and retention policies, which is essential for managing sensitive data consistently.

An enterprise risk policy outlines the organization's overall stance and approach to risk, but it does not specifically detail how data is categorized or handled based on sensitivity.

An Enterprise Risk Management (ERM) framework provides a structure for identifying, assessing, and responding to risks, but it does not directly prescribe how sensitive data should be classified or handled.

An information security policy sets broad rules and guidelines for protecting information assets, but an information classification framework provides the granular detail needed to standardize *how* sensitive data is specifically categorized and handled according to its sensitivity.