Which of the following is required to determine classification and ownership?

Question

Options

• ASystem and data resources are properly identified
• BAccess violations are logged and audited
• CData file references are identified and linked
• DSystem security controls are fully integrated

• A
  88% (29)
• B
  6% (2)
• C
  3% (1)
• D
  3% (1)

Explanation

The required step to determine classification and ownership is to ensure that the system and data resources are properly identified. Identification is the process of assigning unique names or labels to the system and data resources, such as hardware, software, files, databases, or networks. Identification helps to distinguish the system and data resources from each other, and to associate them with their respective owners, custodians, or users. Identification is a prerequisite for classification and ownership, which are the processes of assigning the value, sensitivity, and criticality of the system and data resources, and the roles and responsibilities of the parties involved in their protection and management. Logging and auditing access violations, identifying and linking data file references, and integrating system security controls are not required steps to determine classification and ownership, as they are related to the implementation and monitoring of the security policies and measures, not the identification of the system and data resources.

No community discussion yet for this question.