You have been tasked to develop an effective information classification program. Which one of the following steps should be performed first?

The correct answer is D. Specify the criteria that will determine how data is classified. The first step in developing an information classification program is to define the criteria by which data will be classified (e.g., sensitivity, value, regulatory requirements). Without clear classification criteria, you cannot assign data to categories, identify custodians…

Submitted by klara.se· Apr 18, 2026Security Concepts and Practices

Question

You have been tasked to develop an effective information classification program. Which one of the following steps should be performed first?

Options

AEstablish procedures for periodically reviewing the classification and ownership
BSpecify the security controls required for each classification level
CIdentify the data custodian who will be responsible for maintaining the security level of data
DSpecify the criteria that will determine how data is classified

How the community answered

(26 responses)

A
8% (2)
C
4% (1)
D
88% (23)

Explanation

The first step in developing an information classification program is to define the criteria by which data will be classified (e.g., sensitivity, value, regulatory requirements). Without clear classification criteria, you cannot assign data to categories, identify custodians, specify controls, or establish review procedures. All other steps - assigning custodians, defining controls, and establishing review cycles - depend on having classification criteria established first.

Topics

#Information Classification#Data Classification#Security Program Development#Data Governance

Community Discussion

No community discussion yet for this question.

Full SSCP Practice