Which term corresponds to providing the proper data classification for the information security professionals?

• A. Standard
• B. Stakeholders
• C. System-specific Policies
• D. Technical Control

Answer: (B)

Data classification is driven by the people who own the data and understand its business value. Stakeholders—the data owners and business unit leaders—decide how data should be categorized (for example, public, internal, confidential, restricted) and who should have access to each category. Security professionals then use that classification to apply appropriate protections. Standards set the rules, system-specific policies describe how those rules are enforced within a particular system, and technical controls are the safeguards implemented to enforce the protections. But the actual decision about which data gets which classification level comes from the stakeholders.