Exam CRISC topic 1 question 1213 discussion

The answer is A, you need to understand the impact on the business incase the data were not encrypted.

Agree with D.

Data classification is the first step then comes BIA so i would change it to D

The organization has X number of databases and it is looking to encrypt only a subset of that due to budget constraints; the question is, how would you find the subset, that qualifies for encryption? If you go the data classification route, you would end up choosing to encrypt all of the PII information databases (but budget does not support); if you choose the business critical route through the BIA analysis DBs, you would find a subset of databases that need to be encrypted. I would choose choice A. No?

BIA is the answer

To identify high-risk databases where encryption should be applied, the most useful information would be provided by a data classification scheme. A data classification scheme helps to categorize data based on its sensitivity and the potential impact to the organization if that data were to be compromised. By applying a classification scheme to the databases, the organization can determine which databases contain the most sensitive or critical data, and therefore, have the highest risk associated with them.

BIA gives criticality of business and not data. Data classification tells us importance of data hence D is correct

A database could be non sensitive and not require confidentiality but really require integrity and availability so D is correct.