Explanation
When defining the information classification policy, the requirements of the data owners need to be identified.
The quantity of information, availability of IT infrastructure and benchmarking may be part of the scheme after the fact and would be less relevant.

Explanation/Reference:
Explanation:
Risk analysis should include all organizational activities. It should not be limited to subsets of systems or just systems and infrastructure.

Section: INFORMATION SECURITY PROGRAM MANAGEMENT

Explanation
It is more efficient to establish a baseline standard and then develop additional standards for locations that must meet specific requirements. Seeking a lowest common denominator or just using industry best practices may cause certain locations to fail regulatory compliance. The opposite approach-forcing all locations to be in compliance with the regulations places an undue burden on those locations.

Explanation/Reference:
Explanation:
It is easier to manage and control a centralized structure. Promoting security awareness is an advantage of decentralization. Decentralization allows you to use field security personnel as security missionaries or ambassadors to spread the security awareness message. Decentralized operations allow security administrators to be more responsive. Being close to the business allows decentralized security administrators to achieve a faster turnaround than that achieved in a centralized operation.