Exam CDPSE topic 1 question 110 discussion

You can’t classify or apply controls effectively without understanding the scope of access.

Determining who has access to this data will allow a PIA to be completed and the justification of a major risk will be determined.

B appear more correct, the data has been identified already. Addressing the proliferation of personal data held as unstructured data begins with understanding what data you have and how sensitive it is. Classifying sensitive unstructured data is the first step in this process. Once data is classified, it becomes easier to determine how it should be handled, who should have access to it, and what protective measures should be in place. Classification provides a foundation upon which other actions, such as identifying who has access, assigning ownership, and identifying data at the point of creation, can be based.