Question

During the rollout of a new information security program, the security manager discovers that many critical data assets have been classified inconsistently, with IT staff making classification decisions based on technical storage requirements rather than business value. Which action should the security manager take FIRST to correct this?

Accepted Answer

Assign classification responsibility to the designated business data owners

Answer

Reclassify all affected assets based on the security team's assessment of sensitivity

Answer

Deploy a data discovery tool to automatically classify assets by content

Answer

Apply the highest classification level to all critical assets to ensure protection