A data owner is setting up a new customer analytics data set in the cloud and asks at which phase of the cloud secure data lifecycle a classification should first be assigned to the data, so that later controls can rely on it. Which phase is correct?
Select an answer to reveal the explanation.
Short Explanation
You label a moving box when you pack it, not when you're unloading it at the new place. Classification belongs at Create, so every later phase knows how to treat the data. The trap is Store, which follows almost instantly but depends on a label already being there.
Full Explanation
The cloud secure data lifecycle, as described in CSA Security Guidance, runs through Create, Store, Use, Share, Archive and Destroy. Create covers the generation of new content and the alteration or update of existing content, and it is where classification should first be assigned, because the creator or data owner knows the data's purpose and sensitivity at that moment. Every later phase depends on that label: storage controls, encryption, access policies, sharing restrictions and retention all key off the classification. Store usually happens almost simultaneously with creation and is where the classification is enforced through access controls and encryption, but it relies on a label that already exists rather than being the point where one is decided. Waiting until Use means data has already been stored and possibly accessed without appropriate controls, and sensitivity is discovered by accident rather than by design. Waiting until Share exposes the data before anyone has decided whether it may leave the team. Exam caveat: data modified later re-enters Create, so classification may change over the data's life and must be revisited. Operational check: confirm the data set receives a classification tag at ingestion and that storage policies refuse untagged objects.