An IT auditor is reviewing the data classification for a sensitive system. The company has classified the data
stored in the sensitive system according to the following matrix:
DATA TYPECONFIDENTIALITYINTEGRITYAVAILABILITY
—————————————————————————————————————-
FinancialHIGHHIGHLOW
Client nameMEDIUMMEDIUMHIGH Client addressLOWMEDIUMLOW
—————————————————————————————————————–
AGGREGATEMEDIUMMEDIUMMEDIUM
The auditor is advising the company to review the aggregate score and submit it to senior management. Which
of the following should be the revised aggregate score?

A.
HIGH, MEDIUM, LOW

B.
MEDIUM, MEDIUM, LOW

C.
HIGH, HIGH, HIGH

D.
MEDIUM, MEDIUM, MEDIUM