Question

An information security manager is developing the security program for a large enterprise and must ensure that protection levels applied to data are appropriate and cost-effective. Before selecting and applying baseline controls to the organization's information assets, which activity provides the MOST essential foundation for these decisions?

Accepted Answer

Classifying information assets according to their value, sensitivity, and criticality to the business

Answer

Deploying data loss prevention technology across all endpoints and network egress points

Answer

Conducting a penetration test to identify exploitable vulnerabilities in production systems

Answer

Assigning encryption to every database and file share regardless of content