According to theISACA CRISC Review Manual, thedata classification processidentifies data sensitivity, criticality, and required protection levels.

“The level of protection for data should be based on its classification — i.e., the value of the information to the enterprise, its confidentiality, integrity, and availability requirements.”

Once classification (e.g., confidential, internal, public) is determined, corresponding safeguards (encryption, access control, backup policies) can be appropriately applied.

AandBare broad organizational factors.

C(access requirements) relates to functionality, not classification-based protection.

Therefore,D. Data classificationis correct.

CRISC Reference:Domain 3 – Risk Response and Mitigation, Topic: Information Asset Protection.