Exam CISA topic 1 question 356 discussion

The most important step in implementing a data classification program is to formalize data ownership. Data owners are responsible for determining the classification levels of data based on its sensitivity, criticality, and compliance requirements. Without clear data ownership, it would be difficult to assign accountability for ensuring proper classification and implementing appropriate security controls.

While formalizing data ownership (Option C) is also important for establishing accountability and responsibility for data management, it typically comes after understanding the data classification levels. Data ownership helps ensure that individuals or departments are responsible for managing and protecting specific datasets according to their classification. However, without a clear understanding of the data classification levels, it may be challenging to assign ownership accurately and determine the appropriate level of protection for each dataset. Therefore, understanding the data classification levels is the foundational step in implementing a data classification program.

It's through the Data Owners you get to interview and understand the data classification levels

Data classification involves categorizing data into various levels based on its sensitivity and the impact to the organization if it were compromised. Understanding these levels is crucial to ensure that each type of data is handled appropriately and that adequate security controls are applied.

Understand the data classification level. This is the first step in classifying data then come information asset owner

C. Formalizing data ownership

understand the data classification levels. This involves categorizing data based on its sensitivity, importance, and potential impact if compromised. Data classification levels help define how data should be handled, stored, and protected. Once you have a clear understanding of these levels, you can develop appropriate policies, procedures, and security measures to safeguard the data effectively.

why not B?

C. ownership comes with accountability