A city records clerk invents ad-hoc labels such as "super-secret-plus" that no other department recognizes. What should the information security program prefer for classification?
Select an answer to reveal the explanation.
Short Explanation
Think of street signs—if every block invents its own colors, drivers get lost. Classification works the same way: a short, shared set of labels tied to real impact beats clever one-off stamps nobody else understands. Keep the scheme simple enough that a clerk in Parks and a clerk in Courts mark the same kinds of harm the same way.
Full Explanation
A workable municipal classification program uses a clear, limited set of labels tied to defined impact criteria that the whole organization can apply consistently. Parks, Courts, Utilities, and Records must mark the same kinds of harm the same way so training, tooling, and audits stay coherent. Impact-based criteria—disclosure, alteration, or unavailability consequences for residents and operations—turn labels into control drivers rather than decorative stamps. That consistency is what makes handling standards, encryption choices, and access decisions repeatable across city departments.
Letting each office invent local labels fails by concept: ownership feelings do not create interoperability, and unrecognized markings defeat enterprise handling. Adopting as many specialty markings as possible fails because extreme granularity overwhelms staff, produces inconsistent application, and collapses into the same ad-hoc chaos the clerk already created. Deferring classification until after a breach fails because markings must precede incidents so protective controls exist before harm, not as forensic theater afterward.
Exam caveat: CISSP expects classification schemes that are organization-wide, criteria-based, and usable by non-specialists—not maximal nuance or departmental creativity. Operational check: publish a short label set with impact examples for common city record types, train clerks on those criteria, and sample files quarterly to verify Parks and Courts would apply the same label to equivalent harm.