CISSP Practice Question: In a medium-sized healthcare organization, what would MOST likely happen if asset…

Correct Answer: A. Increased risk of data breaches

Explanation (CISSP Manager Logic):

Asset classification is the foundation of a risk-based security strategy; without it, management cannot identify which high-value assets require stringent controls. Failing to categorize data leads to inconsistent protection levels, leaving sensitive healthcare information exposed to unauthorized access.

By implementing asset classification, you:

• Align security spending with asset criticality
• Ensure compliance with data privacy mandates
• Enable targeted incident response and recovery

While the other options are relevant, they fall short because:

• B: Compliance is hindered when an organization cannot prove it knows where sensitive data resides.
• C: Effective asset management requires accurate classification to track lifecycle and security requirements.
• D: Costs typically increase due to inefficient "one-size-fits-all" security or expensive breach remediation.

Think like a manager:

You cannot protect what you have not identified. Prioritize classification to ensure limited resources are focused on the assets that present the greatest risk to the business.