Which of the following is MOST helpful to an information security manager when determining service level requirements for an outsourced application?

The supplier's BCP is important for resilience, but data classification is a prerequisite for defining what resilience (and other security) levels are needed in the first place.

An information security policy sets overall organizational standards, but data classification translates those policies into specific, measurable requirements for a particular application and its data.

Application capabilities describe what the application does, not the security or service level requirements for the data it handles.

Data classification directly indicates the sensitivity, criticality, and regulatory requirements associated with the information processed by the application. This classification dictates the appropriate security controls, confidentiality, integrity, and availability service levels (SLAs) required from the outsourced vendor to protect the data adequately.