Which of the following should be the FIRST step when developing a data loss prevention (DLP) solution for a large organization?

Creating DLP policies and templates prematurely without knowing what data needs protection will result in ineffective or overly broad policies.

Conducting a threat analysis against sensitive data usage requires prior knowledge of what sensitive data exists and where it is used, which comes from data inventory and classification.

Before any policies can be effectively designed or threats analyzed, an organization must first understand what data it possesses, where it is stored, and how sensitive it is. Data inventory and classification provide the foundational knowledge necessary to define what needs protecting and guide the scope and focus of DLP policies.

Identifying approved data workflows is an important subsequent step, but it cannot be done effectively without first understanding the landscape of the data itself through inventory and classification.