CRISC · Question #333
Which of the following would BEST facilitate the maintenance of data classification requirements?
The correct answer is A. Scheduling periodic audits. Scheduling periodic audits would best facilitate the maintenance of data classification requirements by regularly verifying compliance and identifying necessary adjustments.
Question
Which of the following would BEST facilitate the maintenance of data classification requirements?
Options
- AScheduling periodic audits
- BAssigning a data custodian
- CImplementing technical controls over the assets
- DEstablishing a data loss prevention (DLP) solution
How the community answered
(37 responses)- A84% (31)
- B8% (3)
- C3% (1)
- D5% (2)
Why each option
Scheduling periodic audits would best facilitate the maintenance of data classification requirements by regularly verifying compliance and identifying necessary adjustments.
Periodic audits systematically review whether data is correctly classified according to policy and if associated controls are effectively applied. This regular verification process is crucial for identifying misclassifications, policy deviations, and control gaps, allowing for timely corrective actions and ensuring the ongoing accuracy and effectiveness of the data classification program.
Assigning a data custodian is important for accountability and initial classification, but without audits, there's no independent verification of consistent maintenance.
Implementing technical controls helps enforce classification, but audits are needed to ensure those controls are correctly configured and applied based on accurate, maintained classification.
Establishing a Data Loss Prevention (DLP) solution helps prevent unauthorized data exfiltration based on classification, but it does not directly maintain the classification scheme itself or verify its accuracy over time.
Concept tested: Data classification maintenance
Source: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf
Topics
Community Discussion
No community discussion yet for this question.