The correct answer is D because the primary objective of an information classification scheme is to ensure that information receives protection appropriate to its sensitivity, criticality, value, and risk. Classification labels such as public, internal, confidential, and restricted help determine required controls for access, storage, transmission, encryption, retention, monitoring, and disposal. Legislative and regulatory requirements may influence classification rules, but compliance is not the only objective. Developing an asset inventory is important because organizations need to know what information assets they have, but classification goes further by assigning protection levels. Defining data retention requirements may be supported by classification, but retention is only one control area. In CISM risk management, controls should be risk-based and cost-effective. Overprotecting low-risk data wastes resources, while underprotecting sensitive data increases exposure. A classification scheme enables consistent, proportionate, and risk-aligned protection of information assets. Therefore, the primary objective is to implement controls proportionate to risk.
Reference: CISM Information Risk Management; information classification, data protection, risk-based controls, asset management, and control proportionality principles.