Certified Information Security Manager (CISM) — Question 35

When performing a data classification project, an information security manager should:

Answer options

• A. assign information criticality and sensitivity.
• B. identify information custodians.
• C. identify information owners.
• D. assign information access privileges.

Correct answer: C

Explanation

The correct answer is C because identifying information owners is essential for data classification, as they have the authority and responsibility for the data. Options A, B, and D are important tasks but do not directly relate to the classification process, which primarily focuses on the ownership of the information.