Which function within the IT corporate structure is responsible for classifying information using an agreed-upon classification scheme for a new data collection system?

Information classification is a fundamental control and process within the information security domain. The information security function is responsible for establishing and managing the program to protect the confidentiality, integrity, and availability of information assets. A core part of this responsibility is to define a classification scheme and ensure that data is categorized according to its sensitivity and criticality. This classification then dictates the level of security controls required for protection. While other functions are involved, the primary ownership and execution of information classification rests with information security.

B. Information privacy is a specialized area of security focused on personal data. The general classification of all enterprise information is a broader information security function.
C. IT governance sets the direction and provides oversight. It would ensure a classification policy exists but would not be responsible for the operational task of classifying data for a new system.
D. Enterprise architecture ensures the system's design can support security requirements like data classification, but it does not perform the classification of the information itself.

1. ISACA, COBIT® 2019 Framework: Governance and Management Objectives, 2018. Management Objective APO14 "Managed Data", Practice APO14.04 "Define a data classification scheme", p. 120. This practice is central to data management and security.

2. ISACA, COBIT® 2019 Framework: Governance and Management Objectives, 2018. Management Objective DSS05 "Managed Security Services", p. 201. The entire objective is predicated on understanding the sensitivity of information to apply appropriate protective services.

3. ISO/IEC 27001:2022, Information security, cybersecurity and privacy protection — Information security management systems — Requirements. Annex A, Control 5.12 "Classification of information". This international standard explicitly defines information classification as a core information security control.