Achieving security risk reduction in an organisation begins with developing what?

A change management model, prioritising security changes and then updatingthe active directory

An enterprise data model, rolling out data flow diagrams and enbedding securityinto the database

A security model, classifying each organisational role and putting the physicaldata behind a firewall

A classification model, classifying each data concept and locating the physicaldata

A metadata model, locating the data and moving it into the metadata repository