A migration of personal data involving a data source with outdated documentation has been approved by senior management. Which of the following should be done NEXT?

Given that a data migration has been approved but the source documentation is outdated, the immediate next step is to ensure appropriate data classification. The outdated documentation means the organization cannot be certain about the types, sensitivity, and regulatory requirements of the data being moved. A data discovery and classification exercise must be performed before the migration proceeds to understand what data exists. This allows for the application of correct security controls, handling procedures, and retention policies in the new environment, thereby mitigating the risk of a data breach or non-compliance.

A. Reviewing data flow post-migration is reactive. Risks associated with misclassified sensitive data should be identified and mitigated before the move occurs.
C. Engaging an external auditor is a step for independent verification, which would typically occur after internal due diligence like data classification is completed.
D. Checking version history is insufficient; it does not validate the actual data content, which is the core issue when documentation is unreliable.

1. ISACA, CDPSE Review Manual, 2nd Edition, 2021. Domain 3: Data Lifecycle, Section 3.2, pp. 131-132, highlights data classification as a critical step to determine the level of protection required for data throughout its lifecycle, including during transfers.

2. ISACA, COBIT 2019 Framework: Governance and Management Objectives, 2018. DSS05 (Managed Security Services), p. 207, includes the practice of implementing a system for the classification of information in accordance with its criticality.

3. National Institute of Standards and Technology (NIST), SP 800-53 Rev. 5 Security and Privacy Controls for Information Systems and Organizations, September 2020. Control Family PM-11 (Mission/Business Process Definition), discusses the importance of understanding data to categorize systems and apply appropriate controls.