Information classification is a fundamental step in determining:

A. whether risk analysis objectives are met.
B. who has ownership of information.
C. the type of metrics that should be captured.
D. the security strategy that should be used.