Exam CISA topic 1 question 1201 discussion

While determining data retention policies is important, data classification is first required to implement data protection requirements.

Answer C Data classification is typically implemented to ensure that data is adequately protected based on its sensitivity and criticality. While compliance with the organization's data policies may necessitate data classification, the ultimate goal is often to mitigate risks associated with data breaches, unauthorized access, or data loss. By classifying data according to its level of sensitivity or importance, organizations can establish appropriate security controls, access restrictions, and encryption measures to protect against potential threats. This proactive approach to data protection helps organizations safeguard their valuable assets and maintain trust with stakeholders.

From CRM: "Evaluate data classification practices for alignment with the organization’s policies and applicable external requirements.", so I choose A.