Exam CISA topic 1 question 1495 discussion

As per CRM, it is data policy followed by data classification.

C. Categorize and prioritize data.

The first step when creating a data classification program is to develop a policy. This policy outlines the objectives, scope, and guidelines for classifying data within an organization. It provides the framework for identifying, categorizing, and protecting sensitive information based on its importance and sensitivity. Once the policy is established, the organization can proceed with categorizing and prioritizing data (option C) according to the guidelines outlined in the policy.

Inventorying data assets is the first step.

C. Categorize and prioritize data. Before developing policies or processes, it's essential to categorize and prioritize the organization's data based on its sensitivity, criticality, and regulatory requirements. This step helps identify the different types of data handled by the organization and allows for the implementation of appropriate security controls and measures. Once data has been categorized and prioritized, policies and procedures can be developed to govern its handling, storage, transmission, and disposal in accordance with its classification level. Therefore, categorizing and prioritizing data sets the foundation for effective data classification and management within the organization.