Which policy defines the sensitivity levels of information?

Which policy defines the sensitivity levels of information?

• A. Access Control Policy
• B. Remote-Access Policy
• C. User- Account Policy
• D. Information-Protection Policy

Answer: (D)

Classifying information by sensitivity is governed by an Information-Protection Policy. This policy defines the data classification scheme—levels like public, internal, confidential, and highly confidential—and specifies how each level should be protected. It covers labeling, handling, storage, transmission, and disposal rules so that protections match the data’s risk and importance. By establishing these sensitivity levels, the policy provides a consistent framework that informs how access controls, data handling procedures, and other security controls are applied across the organization. While other policies cover who may access resources, how remote access is managed, or how user accounts are handled, they do not define the categorization and protective requirements for information itself—that role belongs to the information-protection policy.

Classifying information by sensitivity is governed by an Information-Protection Policy. This policy defines the data classification scheme—levels like public, internal, confidential, and highly confidential—and specifies how each level should be protected. It covers labeling, handling, storage, transmission, and disposal rules so that protections match the data’s risk and importance. By establishing these sensitivity levels, the policy provides a consistent framework that informs how access controls, data handling procedures, and other security controls are applied across the organization. While other policies cover who may access resources, how remote access is managed, or how user accounts are handled, they do not define the categorization and protective requirements for information itself—that role belongs to the information-protection policy.