An organization is increasingly concerned about loss of sensitive data and asks the risk practitioner to assess the current risk level. Which of the following should the risk practitioner do FIRST?

Before delving into technical access or incident history, reviewing data ownership for key sensitive assets is the foundational first step because owners are accountable for protecting the data and can provide critical context about its classification, value, and applicable controls. Establishing ownership clarifies responsibilities and guides the subsequent steps in understanding data protection requirements and current controls.

Identifying staff with access is important for a detailed assessment but comes after understanding what data exists and who is responsible for it.

Identifying historical incidents provides valuable context but does not establish the current baseline of data assets and their accountable parties.

While reviewing the data inventory is crucial, understanding who owns that data and is accountable for it is a prerequisite for a meaningful assessment of its risk.