Exam CISM topic 1 question 321 discussion

this question is ambiguous. But classification should be judged by an influence.

B, the business impact

B. The extent that compromise can affect revenue. Classifying application systems is often based on the potential impact of a security breach or compromise. Assessing how a compromise could affect revenue, reputation, data integrity, and other critical business factors helps organizations prioritize their security efforts and allocate resources accordingly. While the other factors mentioned (cost of repairing damage, cost to implement regulatory requirements, and controlling access based on the need to know) are important considerations in information security, they are usually secondary to the primary goal of protecting the organization's revenue and core business functions.

According to the CISM Review Manual, 15th Edition: "Information security policies must address asset classification and handling, including the definition and relative hierarchy of classifications... Organizations should also implement procedures to address authorization based on a need-to-know/need-to-use basis, especially for highly sensitive data."

The extent that compromise can affect revenue

B. The extent that compromise can affect revenue

es loa mas razonable

obviously b

Agree with B

To me, the answer should be B. Classifications shouldn't necessarily determine need to know access. But, classifying systems can show the extent that compromise could impact the company.