An information owner is determining the value of a customer database to set its classification. On what should the valuation PRIMARILY be based?
Select an answer to reveal the explanation.
Short Explanation
A key's worth isn't what you paid at the hardware store; it's what's behind the door it opens. You value information by what the business would suffer if it leaked, got changed or vanished, not by what the server cost.
Full Explanation
For classification, an information asset's value is determined by the consequences to the business if it were compromised. That means assessing the impact of unauthorized disclosure, unauthorized modification and loss of availability, expressed in terms such as financial loss, regulatory penalties, customer harm, reputational damage and operational disruption. These impacts drive the classification level and hence the protection required. The cost of acquiring or developing the system that holds the data reflects an investment in technology, not the value of the information; inexpensive systems can hold extremely sensitive data. The number of users who access the database indicates how widely it is used, which may affect some availability considerations but says little about the harm of a confidentiality or integrity breach. The cost of existing controls reflects past protection decisions, which may be excessive or inadequate, and using it to value the asset reverses the logic, since control spending should follow from the asset's value, not define it. Exam caveat: replacement and recreation costs can feature in impact analysis, but as part of the business impact rather than as the measure itself. Operational check: confirm the classification record shows the owner's impact rating for each of the three properties.