An IT risk assessment for a large healthcare group revealed an increased risk of unauthorized disclosure of information. Which of the following should be established FIRST to address the risk?

Data encryption tools are technical controls that implement protection, but without classification, it's unclear which data needs encryption and to what level.

Data loss prevention (DLP) tools are technical controls designed to prevent data exfiltration, but their effectiveness relies on knowing what data is sensitive, which is determined by classification.

A data classification policy defines what data is sensitive, who can access it, and how it should be protected based on its criticality. This policy acts as the prerequisite for implementing technical controls like encryption or DLP, as it provides the necessary framework to understand what needs protection and how much.

A data retention policy defines how long data should be kept, which is related to data lifecycle but does not directly address the unauthorized disclosure risk in terms of defining sensitivity and access.