The PRIMARY reason for assigning classes of sensitivity and criticality to information resources is
to provide a basis for:

A.
determining the scope for inclusion in an information security program.

B.
defining the level of access controls.

C.
justifying costs for information resources.

D.
determining the overall budget of an information security program.

Explanation:

The assigned class of sensitivity and criticality of the information resource determines the level of
access controls to be put in place. The assignment of sensitivity and criticality takes place with the
information assets that have already been included in the information security program and has

only an indirect bearing on the costs to be incurred. The assignment of sensitivity and criticality
contributes to, but does not decide, the overall budget of the information security program.