What is the purpose of a data classification policy?

• A. To categorize data by sensitivity and apply appropriate handling, access controls, and retention.
• B. To enforce password rotation every 90 days.
• C. To maximize data throughput in networks.
• D. To define software development lifecycle stages.

Answer: (C)

Data classification policy defines how data is labeled according to its level of sensitivity and then dictates the safeguards that apply. By classifying data, an organization can apply the right handling procedures, access controls, and retention rules for each category. This means highly sensitive information gets stronger protections and stricter access, while less sensitive data can operate under lighter controls, which helps balance security with usability. The policy also supports regulatory compliance, data governance, and effective incident response by making clear who can access what and how long data should be kept or disposed of. The other topics mentioned—password rotation, network throughput optimization, and software development lifecycle stages—are separate concerns and not the purpose of a data classification policy.