Q: 7
You have been tasked to develop an effective information classification program. Which one of the
following steps should be performed first?
Options
Discussion
D . You need to set the classification criteria before you do anything else, otherwise you can't decide controls or assign custodians. Everything builds on those criteria. Pretty sure that's how most SSCP frameworks explain it.
D , it's about setting the foundation before anything else. Without those classification criteria, you can't assign security controls or roles properly. B is a common trap but comes later in the process. Pretty sure ISC2 likes D as first step here.
D every time. You have to define the criteria before anything else in a classification program.
D
D first thing is always define the criteria for classifying info before anything else gets built.
Thinking it's B. Setting the required controls for each level sounds like a logical first move before diving into the criteria specifics.
B this time
D is the logical starting point. You really can't set controls or assign responsibilities until you've defined what makes something confidential vs public, etc. Pretty sure that's how ISC2 frames it, but open if someone disagrees.
D imo. You need to know the criteria for classifying data before you can pick controls or assign custodians. B is tempting but it skips a key foundation step. Pretty sure D is what ISC2 wants here, correct me if I'm off.
I was thinking B since you need to specify the controls for each level at the start, right? Controls define how strict you are with different classes. Not 100% on this though, open to other ideas.
Be respectful. No spam.
