Which of the following should be established FIRST so that data owners can consistently assess the level of data protection needed across the enterprise?

A data encryption program is a specific technical control for data protection; its implementation depends on a prior understanding of which data needs what level of protection, derived from classification.

A data risk management program identifies and mitigates data-related risks, but it relies on a foundation of knowing what data exists and its classification to effectively assess potential risks.

A data retention policy defines how long data should be kept, which is a crucial aspect of data lifecycle management, but it doesn't primarily guide the level of protection (e.g., encryption, access) needed during its active life.

A data classification policy defines categories of data (e.g., public, confidential, secret) and assigns protection requirements to each category based on its sensitivity and value. Establishing this policy first provides data owners with a consistent framework to understand and apply the correct level of protection, such as encryption or access controls, to their respective data assets across the enterprise.