Which of the following is the MOST comprehensive resource for prioritizing the implementation of information systems controls?

A data classification policy defines data sensitivity but does not provide a comprehensive framework for prioritizing all information system controls across the entire organization.

Emerging technology trends identify potential future risks or opportunities but are not a structured resource for prioritizing current control implementations.

The IT strategic plan outlines the overall technology direction and priorities of the organization, directly informing which information systems controls are most critical to support those objectives. It provides a holistic view of the organization's goals, allowing for a comprehensive and strategic prioritization of controls that align with business needs.

The risk register documents identified risks and their treatments, which helps prioritize *risk treatments*, but the IT strategic plan provides the overarching context for *all* information systems controls.