CISA Certified Information Systems Auditor – Question1454 - CISA Certified Information Systems Auditor

From a control perspective, the PRIMARY objective of classifying information assets is to:

A. establish guidelines for the level of access controls that should be assigned.
B. ensure access controls are assigned to all information assets.
C. assist management and auditors in risk assessment.
D. identify which assets need to be insured against losses.

Correct Answer: A

Explanation:

Explanation:
Information has varying degrees of sensitivity and criticality in meeting business objectives. By assigning classes or levels of sensitivity and criticality to information resources, management can establish guidelines for the level of access controls that should be assigned. End user management and the security administrator will use these classifications in their risk assessment process to assign a given class to each asset.