ISC2 CISSP Practice Question

The correct answer is "To determine the applicable security controls based on asset characteristics." The fundamental purpose of asset classification is to determine the appropriate level of protection required for different assets based on their value, sensitivity, and criticality to the organization. By classifying assets, an organization can apply the right level of security controls to each asset category, neither under-protecting critical assets nor wasting resources by over-protecting less valuable ones.

While regulatory compliance is important, it's a byproduct or secondary benefit of good classification, not the primary purpose. Similarly, while asset classification does help with inventorying assets and may assist with budgeting decisions, these are secondary benefits rather than the primary purpose. Record-keeping for insurance claims is an administrative function that may be supported by asset classification but is not the primary security-focused reason for implementing such a system.