After water-quality lab results are labeled Sensitive, which next step best reflects how classification should drive asset security?
Select an answer to reveal the explanation.
Short Explanation
The label is not a trophy sticker—it is the ticket that tells you which locks to use. Once lab results are Sensitive, encryption, who can open the file, and how it travels should follow that playbook. Classification without matching controls is just paperwork.
Full Explanation
Once water-quality lab results are labeled Sensitive, the next asset-security step is to select encryption, access, and transmission controls that match the Sensitive handling standard. Classification exists to drive control selection: who may open the file, how it is stored, and how it moves between labs, regulators, and operations. Matching controls convert the label from paperwork into enforceable protection for resident health data and utility decision records.
Leaving handling unchanged until a regulator cites a violation fails by concept: reactive compliance accepts preventable exposure and treats labels as decorative. Publishing Sensitive results on a public dashboard immediately fails because transparency duties do not override classification-driven confidentiality; release must follow lawful disclosure paths, not ignore the label. Deleting the Sensitive label so staff can email from personal accounts fails as willful downgrade—convenience routing is not a legitimate classification change process.
Exam caveat: CISSP links classification to handling standards; knowing the label without applying commensurate controls is incomplete asset security. Operational check: open the Sensitive handling standard, confirm encryption at rest and in transit, least-privilege access groups, approved transmission channels, and sample lab-result transfers for compliance before the next reporting cycle.