Exam CISM topic 1 question 454 discussion

Policy would dictate what type of framework suited for the company.

Strange question...however, I'd go with C here. My best guess and rationale is the following: Categorization is based on the attributes and properties of entities in dataset, whereas Classification is based on the business requirements. In other words, you need a classification framework (a basic structure underlying a system) to figure out the business part and based on that you categorize data.

Identifying the data owners is the first step and is essential to implementing data classification.

Very strange use of words . IMO i don’t know what data classification framework is all about and either data protection policy . I would agree for data classification policy or data protection ,period. Data protection is all about Develop processes and technical controls to identify, classify, securely handle, retain, and dispose of data. Data classification is the first step you have to do in the secure data lifecycle . I’m on the fence .

C. A data classification framework