Question 1012 - CISA discussion

The first step when developing a DLP solution for a large organization is to conduct a data inventory and classification exercise.This step involves identifying and locating all the data assets that the organization owns, generates, or handles, and assigning them to different categories based on their sensitivity, value, and regulatory requirements1.Data inventory and classification is essential for DLP because it helps to determine the scope and objectives of the DLP solution, as well as the appropriate level of protection and monitoring for each data category2.Data inventory and classification also enables the organization to prioritize its DLP efforts based on the risk and impact of data loss or leakage3.

Option B is not correct because identifying approved data workflows across the enterprise is a subsequent step after conducting data inventory and classification.Data workflows are the processes and channels through which data are created, stored, accessed, shared, or transmitted within or outside the organization4.Identifying approved data workflows helps to define the normal and legitimate use of data, as well as to detect and prevent unauthorized or anomalous data activities5. However, before identifying approved data workflows, the organization needs to know what data it has and how it should be classified.

Option C is not correct because conducting a threat analysis against sensitive data usage is another subsequent step after conducting data inventory and classification. Threat analysis is the process of identifying and assessing the potential sources, methods, and impacts of data loss or leakage incidents. Threat analysis helps to design and implement effective DLP controls and countermeasures based on the risk profile of each data category. However, before conducting threat analysis, the organization needs to know what data it has and how it should be classified.

Option D is not correct because creating the DLP policies and templates is the final step after conducting data inventory and classification, identifying approved data workflows, and conducting threat analysis. DLP policies and templates are the rules and configurations that specify how the DLP solution should monitor, detect, report, and respond to data loss or leakage events. DLP policies and templates should be aligned with the organization's business needs, regulatory obligations, and risk appetite. However, before creating the DLP policies and templates, the organization needs to know what data it has, how it should be classified, how it should be used, and what threats it faces.

Data Inventory & Classification: The First Step in Data Protection1

Data Classification: What It Is And Why You Need It2

How to Prioritize Your Data Loss Prevention Strategy in 20203

What Is Data Workflow?Definition & Examples4

How to Identify Data Workflows for Your Business5

Threat Analysis: A Comprehensive Guide for Beginners

How to Conduct a Threat Assessment for Your Business

What Is Data Loss Prevention (DLP)? Definition & Examples

How to Create Effective Data Loss Prevention Policies