Changes to data sensitivity during the data life cycle present the greatest risk for a global organization when implementing a data classification policy, as they may result in data being under-protected or over-protected, leading to potential data breaches, compliance violations, or inefficiencies. Data sensitivity refers to the level of confidentiality, integrity, and availability that the data requires, and it may changedepending on the data's creation, storage, processing,transmission, or disposal. A data classification policy should consider the changes to data sensitivity during the data life cycle and ensure that the appropriate controls and procedures are applied at each stage. Data encryption not applied to all sensitive data, many data assets that need to be classified, and changes to information handling procedures not documented are not the greatest risks, as they do not affect the data classification policy itself, but rather the implementation or execution of the policy. References = CRISC Certified in Risk and Information Systems Control - Question211; ISACA Certified in Risk and Information Systems Control (CRISC) Certification Exam Question and Answers, question 211.

According to the Risk and Information Systems Control documents, implementing record retention tools and techniques is the best solution in this scenario. Record retention involves managing the lifecycle of records, including their creation, usage, storage, and disposal. By implementing record retention policies, organizations can define how long emails and other data should be retained before being deleted. This helps in efficiently managing storage space and reducing unnecessary storage costs.
Establishing e-discovery and data loss prevention (DLP) (Option B) focuses more on legal and compliance aspects and may not directly address the issue of reducing storage costs. Sending notifications when near storage quota (Option C) is a reactive approach and may not prevent the exponential increase in storage costs.
Implementing a bring your own device (BYOD) policy (Option D) is unrelated to the issue of email storage costs.
References = Risk and Information Systems Control Study Manual

A risk heat map is a graphical tool that displays the overall risk of the project to senior management by showing the probability and impact of individual risks in a matrix format. A risk heat map can help to prioritize the risks, communicate the risk exposure, and monitor the risk response. A risk heat map can also show the risk appetite and tolerance levels of the organization, as well as the residual risk after the risk response. The other options are not the most effective ways to represent the overall risk of the project to senior management, although they may be useful or complementary to the risk heat map. Aggregated key performance indicators (KPIs) are metrics that measure the performance of the project against the objectives, but they do not show the uncertainty or variability of the project outcomes. Key risk indicators (KRIs) are metrics that measure the level of risk or the effectiveness of the risk response, but they do not show the relationship between the probability and impact of the risks. A centralizedrisk register is a document that records the details of the individual risks, such as the description, category, cause, effect, probability, impact, response, and status, but it does not show the overall risk of the project in a visual or concise way. References = Managing overall project risk, Project Risk Management - Quick Reference Guide, 10 Common Project Risks (Plus the Steps To Solve Them), What Is Project Risk Management: Benefits, Challenges, Best Practices

A spear phishing attack is a type of cyberattack that targets a specific individual or organization with a fraudulent email that appears to be from a trusted source, and attempts to trick the recipient into clicking a malicious link, opening a malicious attachment, or providing sensitive information. A spear phishing attack can compromise the security, confidentiality, integrity, or availability of the information systems and data of the individual or organization. The most effective way to mitigate the risk associated with spear phishing attacks is to implement a security awareness program, which is a program that educates and trains the employees and stakeholders of the organization about the security policies, procedures, and best practices, and the potential threats and risks that may affect the organization. A security awareness program can help to prevent or reduce the success of spear phishing attacks, as it can increase the knowledge and skills of the employees and stakeholders to recognize and avoid the fraudulent emails, and to report and respond to any suspicious or malicious activities. References = CRISC Review Manual, 7th Edition, page 181.