Question

A multinational manufacturer has no formal data classification program. Engineering blueprints, employee health records, and public marketing brochures are all stored together with identical access controls. The CISO wants to ensure that protection efforts and costs are proportional to the value and sensitivity of each information asset. Which action should the CISO take FIRST to address this problem?

Accepted Answer

Establish a data classification scheme and require information owners to assign classification levels to assets

Answer

Deploy data loss prevention (DLP) technology across all file repositories to block unauthorized transfers

Answer

Encrypt all stored data at rest using AES-256 to guarantee confidentiality regardless of sensitivity

Answer

Grant access to all data on a least-privilege basis determined by the IT department