Before launching a data classification project, the information security manager learns that the organization's information asset inventory is known to be incomplete and lacks named owners for many assets. What should be done FIRST?

Classification and control assignment depend on knowing what information assets exist and who owns them. An incomplete inventory means some assets will never be classified or protected, and missing owners means there is nobody accountable to make the classification decision. Completing the inventory, with named owners, is therefore the prerequisite for a classification project and for allocating controls in proportion to value. Classifying only known assets and waiting for incidents to reveal the rest guarantees that unprotected assets will be discovered through harm, which is the outcome the program is meant to prevent. Applying the highest classification to everything creates excessive cost and friction, encourages staff to bypass handling rules and still does not identify the assets, so many remain unprotected in practice. Implementing controls on systems IT considers critical substitutes a technical view of importance for the business owners' assessment and skips the classification that should determine control levels. Exam caveat: inventory and classification can overlap in phases for large organizations, but each asset must be identified and owned before it is classified. Operational check: confirm the inventory records every in-scope asset with a named owner and that discovery methods are used to find unlisted assets.