Which of the following should be the FIRST consideration when developing a strategy for protecting an organization's data?

The correct answer is A. Classification. Data classification must come first because you cannot appropriately protect data without first knowing what type of data you have and how sensitive it is. Classification defines the value and risk associated with different data categories, which then drives decisions about…

Submitted by noor.lb· Apr 18, 2026Information Security Program Development and Management

Question

Which of the following should be the FIRST consideration when developing a strategy for protecting an organization’s data?

Options

AClassification
BEncryption
CAccess monitoring
DAccess rights

How the community answered

(36 responses)

A
94% (34)
C
3% (1)
D
3% (1)

Explanation

Data classification must come first because you cannot appropriately protect data without first knowing what type of data you have and how sensitive it is. Classification defines the value and risk associated with different data categories, which then drives decisions about encryption strength (B), who should have access rights (D), and what level of access monitoring (C) is warranted. Applying controls uniformly without classification wastes resources on low-value data and may under-protect critical data. Classification is the foundational step upon which all other data protection measures are built.

Topics

#Data classification#Data protection#Security strategy#Information asset management

Community Discussion

No community discussion yet for this question.

Full CISM Practice