CISSP Practice Question: A data owner must determine the appropriate security controls for a new…

Correct Answer: A. The potential impact to the organization if the data is compromised

Explanation (CISSP Manager Logic):

Classification is fundamentally based on the value of the data and the negative impact of its loss or disclosure (Confidentiality, Integrity, and Availability). A manager must prioritize risk-based decision-making over technical or budgetary constraints when defining sensitivity.

By focusing on potential impact, you:

• Align security expenditures with actual business risk
• Ensure compliance with legal and regulatory obligations
• Provide a consistent framework for selecting baseline controls

While the other options are relevant, they fall short because:

• B: Cost is a consideration for control selection, but it does not define the inherent value or sensitivity of the information.
• C: Volume may increase the scale of a breach, but a single highly sensitive record can require a higher classification than millions of public records.
• D: The system owner is responsible for maintaining the data, but the data owner (business lead) must define the classification based on business needs.

Think like a manager:

Security is a business enabler; classification must reflect the business's risk tolerance and the potential harm to the mission rather than technical limitations.