Which of the following MUST be established before implementing an information architecture that restricts access to data based on sensitivity?

Risk and control frameworks provide the overall context for security but do not, in themselves, define the specific sensitivity or ownership of individual data elements.

Probability and impact analysis is part of risk assessment and quantifies potential harm but does not establish the fundamental classification or ownership of data.

Before restricting access based on sensitivity, an organization MUST classify its data to determine what is sensitive and establish data ownership to assign accountability, as these foundations define the criteria for applying access controls in the information architecture.

Security and privacy policies define the rules for protecting data but rely on prior classification and ownership to be effectively implemented and enforced regarding sensitivity-based access.