A company is drafting the data classification policy for a new cloud program and must decide what should determine the classification level assigned to each data set. Which set of criteria should drive those levels?
Select an answer to reveal the explanation.
Short Explanation
Classification asks one question: how bad would it be if this data leaked, changed or vanished? Sensitivity, legal duties, value and criticality answer that. Where you store it or how big the file is doesn't change how much it matters.
Full Explanation
A classification policy defines levels and the criteria used to assign data to them, so that protection is proportional to the harm that loss of confidentiality, integrity or availability would cause. The usual criteria are sensitivity of the content, legal, regulatory and contractual obligations that apply to it, its value to the organization and to others, and its criticality to business operations. Together these determine the impact of compromise and therefore the controls required. File format, size, storage tier and creation date are technical attributes useful for discovery and storage management, but they say nothing about how damaging disclosure or loss would be; a small text file can hold extremely sensitive data. The service model, region and provider describe where and how data is hosted; they influence which controls are available and may raise jurisdictional issues, but classification should be independent of location so it follows the data wherever it moves. The number of users and frequency of access describe usage patterns, which inform access management and storage tiering but not sensitivity. Exam caveat: classification should drive control selection, not the reverse. Operational check: test the draft criteria against several representative data sets and confirm owners reach consistent levels.