Once a company's resources are enumerated, the next step is to ________.

• A. create a protection plan for each
• B. assess the degree to which each is already protected
• C. enumerate threats to each
• D. classify them according to sensitivity

Answer: (D)

After you’ve completed an inventory of resources, the next move is to classify them by sensitivity or criticality. This step establishes how valuable each asset is and how much impact its loss or compromise would have on the organization. By labeling assets with their risk level, you create a basis for applying the right protections where they matter most. This prioritization prevents over-protecting low-risk items and under-protecting high-risk ones, guiding decisions on access controls, encryption, monitoring, and incident response.

Protection planning, assessing current protections, and enumerating threats are all important parts of the broader security program, but they rely on first knowing which assets are most sensitive and deserve the strongest controls. Classification provides the criteria to determine appropriate protections and resource allocation.