Which of the following should be the FRST step when developing a data toes prevention (DIP) solution for a large organization?

The foundational step in developing any data protection program, including Data Loss Prevention (DLP), is to understand the data assets that require protection. An organization must first conduct a comprehensive inventory to discover what data it possesses and where it resides. Following the inventory, a classification exercise assigns a value or sensitivity level (e.g., public, confidential, restricted) to the data. This initial step is critical because all subsequent activities—such as defining protection policies, analyzing threats, and mapping data flows—are entirely dependent on knowing what data needs to be protected and to what degree.

A. Identifying approved data workflows is a necessary step to understand how data moves, but it can only be done effectively after the sensitive data has been identified and classified.

B. A threat analysis is performed against specific assets. It is impossible to accurately assess threats to sensitive data without first defining what constitutes "sensitive data" through classification.

C. Creating DLP policies and templates is a subsequent phase. Policies are the rules designed to protect data based on its classification, making this step dependent on the initial inventory.

1. ISACA CISA Review Manual

27th Edition. Domain 4: Information Asset Protection

Section 4.3. The manual emphasizes that information classification is a primary and fundamental step in establishing an information security program. It states

"The classification of information assets is one of the first and most important steps in the development of an information security program

" which provides the basis for applying appropriate controls

such as those in a DLP solution.

2. National Institute of Standards and Technology (NIST) Special Publication 800-53

Revision 5. Security and Privacy Controls for Information Systems and Organizations. Control family "System and Information Integrity (SI)

" specifically control SI-12 "Information Handling and Retention

" presupposes that information has been identified and categorized to apply appropriate handling procedures. This highlights the foundational nature of data identification and classification.

3. Asma

U.

& Zeeshan

M. (2018). A Framework for the Successful Implementation of Data Loss Prevention (DLP) Solution. 2018 International Conference on Computing

Mathematics and Engineering Technologies (iCoMET). The proposed framework outlines the implementation process

identifying "Data Discovery and Classification" as the initial

prerequisite phase before policy definition and enforcement. (DOI: 10.1109/ICOMET.2018.8346371

Section III.A).