Exam CISM topic 1 question 668 discussion

without having an inventory of data, you will not know which components to protect.

C. Create an inventory of systems where personal data is stored. When establishing a new data protection program that must comply with applicable data privacy regulations, the first step should be to create an inventory of systems where personal data is stored. This step is crucial for understanding the scope of personal data processing within the organization, which is foundational to developing effective data protection policies and procedures. Options A, B, and D are important considerations in building a comprehensive data protection program, but creating an inventory of systems is the initial step to gain visibility into where personal data resides within the organization.

A and C are wrong because they only referenced personal data

if the use of the word "when" indicates before, then B is correct, but if it indicates concurrently, then C is correct

Going with B. Don't see how C is specific to personal data in the context of the question

Going with B. Don't see how C is specific to personal data in the context of the question

C. Create an inventory of systems where personal data is stored.