Exam 712-50 topic 1 question 31 discussion

Asset classification is 1st in order to understand how these controls should be applied. Once classified, we are ready to explore the controls in place and identify gaps Vs defined applicable controls

After defining the standard security controls and the conditions for their application, the next step is to analyze the existing controls on the systems to identify any gaps or overlaps. This analysis helps in understanding how well the current controls align with the new standards and where adjustments or enhancements are needed. By doing this, the organization can ensure that the new controls are effectively integrated and that all systems comply with the updated security requirements.

Asset classification is the first step

analyze existing controls. asset classification must be in place already. how to apply the correct controls if you do not know the asset classification?

What happens before you apply controls, you need to know your assets and what level of protection they need based on the standards.

Since the organization has already defined its security controls and their application conditions, the next step is to analyze the existing controls on systems (Option C). This will help the organization understand where these standard controls need to be applied or where existing controls may need to be updated.