Question

An organization is launching an enterprise data protection program. Management wants to ensure that encryption, access restrictions, and retention rules are applied proportionately across all information assets. Before selecting specific technical controls, which activity should the IS auditor recommend be completed FIRST?

Accepted Answer

Establish and apply a data classification scheme based on asset sensitivity and business value

Answer

Deploy a data loss prevention solution to inspect outbound traffic

Answer

Implement full-disk encryption on all endpoints and servers

Answer

Configure role-based access controls for all file shares