An IT auditor is reviewing the data classification for a sensitive system. The company has classified the data
stored in the sensitive system according to the following matrix:
DATA TYPE CONFIDENTIALITY INTEGRITY
AVAILABILITY
—————————————————————————————————————- Financial HIGH HIGH
LOW
Client name MEDIUM MEDIUM HIGH
Client address LOW MEDIUM LOW
—————————————————————————————————————– AGGREGATE MEDIUM
MEDIUM MEDIUM
The auditor is advising the company to review the aggregate score and submit it to senior management. Which
of the following should be the revised aggregate score?

A.
HIGH, MEDIUM, LOW

B.
MEDIUM, MEDIUM, LOW

C.
HIGH, HIGH, HIGH

D.
MEDIUM, MEDIUM, MEDIUM